dhdutil: Update to support driver 1.88.X

Change-Id: I1534b89fb483fd7d28c8ed1219bcbe1d1e7c4f45
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

48 files changed, 11969 insertions, 4691 deletions

diff --git a/bcmdhd/dhdutil/Android.mk b/bcmdhd/dhdutil/Android.mk
index bc4c27b..16cbc78 100644
--- a/bcmdhd/dhdutil/Android.mk
+++ b/bcmdhd/dhdutil/Android.mk
@@ -1,7 +1,7 @@
 #
 # Copyright (C) 2008-2011 Broadcom Corporation
 #
-# $Id: Android.mk,v 2.6 2009-05-07 18:25:15 hharte Exp $
+# $Id: Android.mk,v 2.6 2009-05-07 18:25:15 $
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/bcmdhd/dhdutil/bcmutils.c b/bcmdhd/dhdutil/bcmutils.c
index 7ecea8e..0fdbe73 100644
--- a/bcmdhd/dhdutil/bcmutils.c
+++ b/bcmdhd/dhdutil/bcmutils.c
@@ -1,7 +1,7 @@
 /*
  * Driver O/S-independent utility routines
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmutils.c 312855 2012-02-04 02:01:18Z $
+ * $Id: bcmutils.c 380908 2013-01-24 12:26:18Z $
  */
 
 #include <bcm_cfg.h>
@@ -187,7 +187,7 @@ pktsegcnt_war(osl_t *osh, void *p)
 }
 
 uint8 * BCMFASTPATH
-pktoffset(osl_t *osh, void *p,  uint offset)
+pktdataoffset(osl_t *osh, void *p,  uint offset)
 {
 	uint total = pkttotlen(osh, p);
 	uint pkt_off = 0, len = 0;
@@ -206,6 +206,25 @@ pktoffset(osl_t *osh, void *p,  uint offset)
 	return (uint8*) (pdata+pkt_off);
 }
 
+
+/* given a offset in pdata, find the pkt seg hdr */
+void *
+pktoffset(osl_t *osh, void *p,  uint offset)
+{
+	uint total = pkttotlen(osh, p);
+	uint len = 0;
+
+	if (offset > total)
+		return NULL;
+
+	for (; p; p = PKTNEXT(osh, p)) {
+		len += PKTLEN(osh, p);
+		if (len > offset)
+			break;
+	}
+	return p;
+}
+
 /*
  * osl multiple-precedence packet queue
  * hi_prec is always >= the number of the highest non-empty precedence
@@ -319,6 +338,44 @@ pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p)
 }
 
 void * BCMFASTPATH
+pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg)
+{
+	struct pktq_prec *q;
+	void *p, *prev = NULL;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+	p = q->head;
+
+	while (p) {
+		if (fn == NULL || (*fn)(p, arg)) {
+			break;
+		} else {
+			prev = p;
+			p = PKTLINK(p);
+		}
+	}
+	if (p == NULL)
+		return NULL;
+
+	if (prev == NULL) {
+		if ((q->head = PKTLINK(p)) == NULL)
+			q->tail = NULL;
+	} else {
+		PKTSETLINK(prev, PKTLINK(p));
+	}
+
+	q->len--;
+
+	pq->len--;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void * BCMFASTPATH
 pktq_pdeq_tail(struct pktq *pq, int prec)
 {
 	struct pktq_prec *q;
@@ -649,6 +706,7 @@ pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
 
 #endif /* BCMDRIVER */
 
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
 const unsigned char bcm_ctype[] = {
 
 	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 0-7 */
@@ -962,6 +1020,7 @@ bcm_ether_atoe(const char *p, struct ether_addr *ea)
 
 	return (i == 6);
 }
+#endif	/* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
 
 
 #if defined(CONFIG_USBRNDIS_RETAIL) || defined(NDIS_MINIPORT_DRIVER)
@@ -1073,7 +1132,7 @@ pktsetprio(void *pkt, bool update_vtag)
 
 	eh = (struct ether_header *) pktdata;
 
-	if (ntoh16(eh->ether_type) == ETHER_TYPE_8021Q) {
+	if (eh->ether_type == hton16(ETHER_TYPE_8021Q)) {
 		uint16 vlan_tag;
 		int vlan_prio, dscp_prio = 0;
 
@@ -1082,7 +1141,7 @@ pktsetprio(void *pkt, bool update_vtag)
 		vlan_tag = ntoh16(evh->vlan_tag);
 		vlan_prio = (int) (vlan_tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
 
-		if (ntoh16(evh->ether_type) == ETHER_TYPE_IP) {
+		if (evh->ether_type == hton16(ETHER_TYPE_IP)) {
 			uint8 *ip_body = pktdata + sizeof(struct ethervlan_header);
 			uint8 tos_tc = IP_TOS46(ip_body);
 			dscp_prio = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
@@ -1109,7 +1168,7 @@ pktsetprio(void *pkt, bool update_vtag)
 			evh->vlan_tag = hton16(vlan_tag);
 			rc |= PKTPRIO_UPD;
 		}
-	} else if (ntoh16(eh->ether_type) == ETHER_TYPE_IP) {
+	} else if (eh->ether_type == hton16(ETHER_TYPE_IP)) {
 		uint8 *ip_body = pktdata + sizeof(struct ether_header);
 		uint8 tos_tc = IP_TOS46(ip_body);
 		priority = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
@@ -1218,6 +1277,7 @@ bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, int len, bool set)
 #endif	/* BCMDRIVER */
 
 
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
 /*******************************************************************************
  * crc8
  *
@@ -1574,10 +1634,36 @@ bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
 	}
 	return NULL;
 }
+#endif	/* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
 
 #if defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || defined(WLMSG_ASSOC) || \
 	defined(DHD_DEBUG)
 int
+bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 flags, char* buf, int len)
+{
+	int i, slen = 0;
+	uint32 bit, mask;
+	const char *name;
+	mask = bd->mask;
+	if (len < 2 || !buf)
+		return 0;
+
+	buf[0] = '\0';
+
+	for (i = 0;  (name = bd->bitfield[i].name) != NULL; i++) {
+		bit = bd->bitfield[i].bit;
+		if ((flags & mask) == bit) {
+			if (len > (int)strlen(name)) {
+				slen = strlen(name);
+				strncpy(buf, name, slen+1);
+			}
+			break;
+		}
+	}
+	return slen;
+}
+
+int
 bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len)
 {
 	int i;
@@ -1694,9 +1780,6 @@ static const char *crypto_algo_names[] = {
 	"UNDEF",
 	"UNDEF",
 	"UNDEF",
-#ifdef BCMWAPI_WPI
-	"WAPI",
-#endif /* BCMWAPI_WPI */
 	"UNDEF"
 };
 
@@ -1999,6 +2082,39 @@ bcm_print_bytes(const char *name, const uchar *data, int len)
 	}
 	printf("\n");
 }
+
+/* Look for vendor-specific IE with specified OUI and optional type */
+bcm_tlv_t *
+find_vendor_ie(void *tlvs, int tlvs_len, const char *voui, uint8 *type, int type_len)
+{
+	bcm_tlv_t *ie;
+	uint8 ie_len;
+
+	ie = (bcm_tlv_t*)tlvs;
+
+	/* make sure we are looking at a valid IE */
+	if (ie == NULL ||
+	    !bcm_valid_tlv(ie, tlvs_len))
+		return NULL;
+
+	/* Walk through the IEs looking for an OUI match */
+	do {
+		ie_len = ie->len;
+		if ((ie->id == DOT11_MNG_PROPR_ID) &&
+		    (ie_len >= (DOT11_OUI_LEN + type_len)) &&
+		    !bcmp(ie->data, voui, DOT11_OUI_LEN))
+		{
+			/* compare optional type */
+			if (type_len == 0 ||
+			    !bcmp(&ie->data[DOT11_OUI_LEN], type, type_len)) {
+				return (ie);		/* a match */
+			}
+		}
+	} while ((ie = bcm_next_tlv(ie, &tlvs_len)) != NULL);
+
+	return NULL;
+}
+
 #if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
 	defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
 #define SSID_FMT_BUF_LEN	((4 * DOT11_MAX_SSID_LEN) + 1)
@@ -2086,3 +2202,93 @@ process_nvram_vars(char *varbuf, unsigned int len)
 
 	return buf_len;
 }
+
+/* calculate a * b + c */
+void
+bcm_uint64_multiple_add(uint32* r_high, uint32* r_low, uint32 a, uint32 b, uint32 c)
+{
+#define FORMALIZE(var) {cc += (var & 0x80000000) ? 1 : 0; var &= 0x7fffffff;}
+	uint32 r1, r0;
+	uint32 a1, a0, b1, b0, t, cc = 0;
+
+	a1 = a >> 16;
+	a0 = a & 0xffff;
+	b1 = b >> 16;
+	b0 = b & 0xffff;
+
+	r0 = a0 * b0;
+	FORMALIZE(r0);
+
+	t = (a1 * b0) << 16;
+	FORMALIZE(t);
+
+	r0 += t;
+	FORMALIZE(r0);
+
+	t = (a0 * b1) << 16;
+	FORMALIZE(t);
+
+	r0 += t;
+	FORMALIZE(r0);
+
+	FORMALIZE(c);
+
+	r0 += c;
+	FORMALIZE(r0);
+
+	r0 |= (cc % 2) ? 0x80000000 : 0;
+	r1 = a1 * b1 + ((a1 * b0) >> 16) + ((b1 * a0) >> 16) + (cc / 2);
+
+	*r_high = r1;
+	*r_low = r0;
+}
+
+/* calculate a / b */
+void
+bcm_uint64_divide(uint32* r, uint32 a_high, uint32 a_low, uint32 b)
+{
+	uint32 a1 = a_high, a0 = a_low, r0 = 0;
+
+	if (b < 2)
+		return;
+
+	while (a1 != 0) {
+		r0 += (0xffffffff / b) * a1;
+		bcm_uint64_multiple_add(&a1, &a0, ((0xffffffff % b) + 1) % b, a1, a0);
+	}
+
+	r0 += a0 / b;
+	*r = r0;
+}
+
+#ifndef setbit     /* As in the header file */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+/* Set bit in byte array. */
+void
+setbit(void *array, uint bit)
+{
+	((uint8 *)array)[bit / NBBY] |= 1 << (bit % NBBY);
+}
+
+/* Clear bit in byte array. */
+void
+clrbit(void *array, uint bit)
+{
+	((uint8 *)array)[bit / NBBY] &= ~(1 << (bit % NBBY));
+}
+
+/* Test if bit is set in byte array. */
+bool
+isset(const void *array, uint bit)
+{
+	return (((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY)));
+}
+
+/* Test if bit is clear in byte array. */
+bool
+isclr(const void *array, uint bit)
+{
+	return ((((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY))) == 0);
+}
+#endif /* BCMUTILS_BIT_MACROS_USE_FUNCS */
+#endif /* setbit */
diff --git a/bcmdhd/dhdutil/dhdu.c b/bcmdhd/dhdutil/dhdu.c
index 5de111a..6b2007c 100644
--- a/bcmdhd/dhdutil/dhdu.c
+++ b/bcmdhd/dhdutil/dhdu.c
@@ -1,7 +1,7 @@
 /*
  * Common code for DHD command-line utility
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu.c 355225 2012-09-05 22:35:10Z $
+ * $Id: dhdu.c 385965 2013-02-19 04:33:34Z $
  */
 
 /* For backwards compatibility, the absence of the define 'BWL_NO_FILESYSTEM_SUPPORT'
@@ -44,24 +44,20 @@
 #include <bcmendian.h>
 #include "dhdu.h"
 #include "miniopt.h"
-/* #include <usbrdl.h> */
 #include <proto/bcmip.h>
+#include <hndrte_debug.h>
+#include <hndrte_armtrap.h>
+#include <hndrte_cons.h>
 #define IPV4_ADDR_LEN 4
-#ifdef WLBTAMP
-#include <proto/bt_amp_hci.h>
-#endif
 
 #include <errno.h>
 
 #include <trxhdr.h>
-/* #include "ucode_download.h"  Greg */
+#include "ucode_download.h"
 
 #define stricmp strcasecmp
 #define strnicmp strncasecmp
 
-#ifndef RDL_CHUNK
-#define RDL_CHUNK	1500
-#endif
 
 static cmd_func_t dhd_var_void;
 static cmd_func_t dhd_varint, dhd_varstr;
@@ -78,7 +74,7 @@ static cmd_func_t dhd_sdreg;
 static cmd_func_t dhd_sd_msglevel, dhd_sd_blocksize, dhd_sd_mode, dhd_sd_reg;
 static cmd_func_t dhd_dma_mode;
 static cmd_func_t dhd_membytes, dhd_download, dhd_dldn,
-	dhd_upload, dhd_vars, dhd_idleclock, dhd_idletime;
+	dhd_upload, dhd_coredump, dhd_consoledump, dhd_vars, dhd_idleclock, dhd_idletime;
 static cmd_func_t dhd_logstamp;
 
 static cmd_func_t dhd_hostreorder_flows;
@@ -86,6 +82,7 @@ static cmd_func_t dhd_hostreorder_flows;
 #ifdef PROP_TXSTATUS
 static cmd_func_t dhd_proptxstatusenable;
 static cmd_func_t dhd_proptxstatusmode;
+static cmd_func_t dhd_proptxopt;
 #endif
 static int dhd_var_getbuf(void *dhd, char *iovar, void *param, int param_len, void **bufptr);
 static int dhd_var_setbuf(void *dhd, char *iovar, void *param, int param_len);
@@ -100,10 +97,6 @@ static int file_size(char *fname);
 static int read_vars(char *fname, char *buf, int buf_maxlen);
 #endif
 
-#ifdef WLBTAMP
-static cmd_func_t wl_HCI_cmd;
-static cmd_func_t wl_HCI_ACL_data;
-#endif
 
 /* dword align allocation */
 static union {
@@ -115,6 +108,9 @@ static char *buf = (char*) &bufstruct_dhd.bufdata;
 /* integer output format, default to signed integer */
 static uint8 int_fmt;
 
+#define DEBUG_INFO_PTRS_END 0xffffffff
+const uint32 debug_info_ptrs[] = {0xf8, 0x878, DEBUG_INFO_PTRS_END};
+
 typedef struct {
 	uint value;
 	char *string;
@@ -177,7 +173,9 @@ cmd_t dhd_cmds[] = {
 	"logcal <n>  -- log around an osl_delay of <n> usecs"},
 	{ "logstamp", dhd_logstamp, -1, DHD_SET_VAR,
 	"logstamp [<n1>] [<n2>]  -- add a message to the log"},
-	{ "memsize", dhd_varint, DHD_GET_VAR, -1,
+	{ "ramstart", dhd_varint, DHD_GET_VAR, -1,
+	"display start address of onchip SOCRAM"},
+	{ "ramsize", dhd_varint, DHD_GET_VAR, -1,
 	"display size of onchip SOCRAM"},
 	{ "membytes", dhd_membytes, DHD_GET_VAR, DHD_SET_VAR,
 	"membytes [-h | -r | -i] <address> <length> [<data>]\n"
@@ -198,6 +196,13 @@ cmd_t dhd_cmds[] = {
 	{ "vars", dhd_vars, DHD_GET_VAR, DHD_SET_VAR,
 	"vars [<file>]\n"
 	"\toverride SPROM vars with <file> (before download)\n"},
+	{ "coredump", dhd_coredump, -1, -1,
+	"coredump <file>\n"
+	"\tdump dongle RAM content into a file in dumpfile format\n"
+	"\tfor use with ELF core generator"},
+	{ "consoledump", dhd_consoledump, -1, -1,
+	"consoledump\n"
+	"\tdump dongle debug console buffer"},
 	{ "upload", dhd_upload, -1, -1,
 	"upload [-a <address> ] <file> [<size>]\n"
 	"\tupload dongle RAM content into a file\n"
@@ -273,6 +278,8 @@ cmd_t dhd_cmds[] = {
 	"set the divisor for SDIO clock generation"},
 	{ "sd_power", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"set the SD Card slot power"},
+	{ "sd_power_save", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"set the SDIO3.0 power save value"},
 	{ "sd_clock", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"turn on/off the SD Clock"},
 	{ "sd_crc", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
@@ -291,14 +298,6 @@ cmd_t dhd_cmds[] = {
 	"Move device into or out of reset state (1/reset, or 0/operational)"},
 	{ "ioctl_timeout", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"IOCTL response timeout (milliseconds)."},
-#ifdef WLBTAMP
-	{ "HCI_cmd", wl_HCI_cmd, -1, DHD_SET_VAR,
-	"carries HCI commands to the driver\n"
-	"\tusage: dhd HCI_cmd <command> <args>\n" },
-	{ "HCI_ACL_data", wl_HCI_ACL_data, -1, DHD_SET_VAR,
-	"carries HCI ACL data packet to the driver\n"
-	"\tusage: dhd HCI_ACL_data <logical link handle> <data>\n" },
-#endif
 #ifdef PROP_TXSTATUS
 	{ "proptx", dhd_proptxstatusenable, DHD_GET_VAR, DHD_SET_VAR,
 	"enable/disable the proptxtstatus feature\n"
@@ -309,6 +308,10 @@ cmd_t dhd_cmds[] = {
 	"0 - Unsupported\n"
 	"1 - Use implied credit from a packet status\n"
 	"2 - Use explicit credit\n" },
+	{ "proptx_opt", dhd_proptxopt, DHD_GET_VAR, DHD_SET_VAR,
+	"enable/disable proptxtstatus optimizations to increase throughput:\n"
+	"0 - Unsupported\n"
+	"1 - Enable proptxstatus optimizations to increase throughput\n" },
 #endif
 	{ "sd_uhsimode", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"g/set UHSI Mode"},
@@ -318,6 +321,10 @@ cmd_t dhd_cmds[] = {
 	"max glom size for sdio tx\n"},
 	{ "txglommode", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"glom mode for sdio tx 0- copy, 1- multidescriptor\n"},
+	{ "fw_hang_report", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"enable/disable report firmware hangs for firmware reload\n"
+	"0 - disabled (for testing)\n"
+	"1 - enabled (default)\n"},
 	{ NULL, NULL, 0, 0, NULL }
 };
 
@@ -437,7 +444,7 @@ dhd_list(void *dhd, cmd_t *garb, char **argv)
 	buf = malloc(len);
 	if (buf == NULL) {
 		fprintf(stderr, "Failed to allocate buffer of %d bytes\n", len);
-		return COMMAND_ERROR;
+		return BCME_NOMEM;
 	}
 	for (i = 0; i < len; i++)
 		*(buf+i) = 0;
@@ -513,11 +520,11 @@ dhd_check(void *dhd)
 	int ret;
 	int val;
 
-	if ((ret = dhd_get(dhd, DHD_GET_MAGIC, &val, sizeof(int)) < 0))
+	if ((ret = dhd_get(dhd, DHD_GET_MAGIC, &val, sizeof(int))) < 0)
 		return ret;
 	if (val != DHD_IOCTL_MAGIC)
 		return -1;
-	if ((ret = dhd_get(dhd, DHD_GET_VERSION, &val, sizeof(int)) < 0))
+	if ((ret = dhd_get(dhd, DHD_GET_VERSION, &val, sizeof(int))) < 0)
 		return ret;
 	if (val > DHD_IOCTL_VERSION) {
 		fprintf(stderr, "Version mismatch, please upgrade\n");
@@ -599,7 +606,7 @@ dhd_pktgen(void *dhd, cmd_t *cmd, char **argv)
 	if (pktgen.version != DHD_PKTGEN_VERSION) {
 		fprintf(stderr, "pktgen version mismatch (module %d app %d)\n",
 		        pktgen.version, DHD_PKTGEN_VERSION);
-		return COMMAND_ERROR;
+		return BCME_ERROR;
 	}
 
 	/* Presence of args implies a set, else a get */
@@ -661,14 +668,14 @@ dhd_pktgen(void *dhd, cmd_t *cmd, char **argv)
 				else {
 					fprintf(stderr, "unrecognized dir mode %s\n",
 					        opts.valstr);
-					return USAGE_ERROR;
+					return BCME_USAGE_ERROR;
 				}
 				break;
 
 			default:
 				fprintf(stderr, "option parsing error (key %s valstr %s)\n",
 				        opts.key, opts.valstr);
-				ret = USAGE_ERROR;
+				ret = BCME_USAGE_ERROR;
 				goto exit;
 			}
 		}
@@ -752,20 +759,20 @@ dhd_sd_blocksize(void *dhd, cmd_t *cmd, char **argv)
 
 	if (argc < 1 || argc > 2) {
 		printf("required args: function [size] (size 0 means max)\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	func = strtol(argv[1], &endptr, 0);
 	if (*endptr != '\0') {
 		printf("Invalid function: %s\n", argv[1]);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	if (argc > 1) {
 		size = strtol(argv[2], &endptr, 0);
 		if (*endptr != '\0') {
 			printf("Invalid size: %s\n", argv[1]);
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	}
 
@@ -800,7 +807,7 @@ dhd_sd_mode(void *wl, cmd_t *cmd, char **argv)
 		} else if (!strcmp(argv[1], "sd4")) {
 			strcpy(argv[1], "2");
 		} else {
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 
 		ret = dhd_var_setint(wl, cmd, argv);
@@ -848,7 +855,7 @@ dhd_dma_mode(void *wl, cmd_t *cmd, char **argv)
 		} else if (!stricmp(argv[1], "adma2")) {
 			strcpy(argv[1], "3");
 		} else {
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 
 		ret = dhd_var_setint(wl, cmd, argv);
@@ -891,13 +898,13 @@ dhd_sdreg(void *dhd, cmd_t *cmd, char **argv)
 	/* required args: offset (will default size) */
 	if (argc < 1) {
 		printf("required args: offset[/size] [value]\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	sdreg.offset = strtoul(argv[1], &ptr, 0);
 	if (*ptr && *ptr != '/') {
 		printf("Bad arg: %s\n", argv[1]);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	/* read optional /size */
@@ -905,7 +912,7 @@ dhd_sdreg(void *dhd, cmd_t *cmd, char **argv)
 		sdreg.func = strtol((ptr+1), &ptr, 0);
 		if (*ptr || ((sdreg.func != 2) && sdreg.func != 4)) {
 			printf("Bad size option?\n");
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	}
 	else {
@@ -917,7 +924,7 @@ dhd_sdreg(void *dhd, cmd_t *cmd, char **argv)
 		sdreg.value = strtoul(argv[2], &ptr, 0);
 		if (*ptr) {
 			printf("Bad value: %s\n", argv[2]);
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	}
 
@@ -983,36 +990,36 @@ dhd_membytes(void *dhd, cmd_t *cmd, char **argv)
 	/* required args: address size [<data>]] */
 	if (argc < 2) {
 		fprintf(stderr, "required args: address size [<data>]\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	if (argc < 3 && hexin) {
 		fprintf(stderr, "missing <data> required by -h\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 	if ((argc > 2) && (rawout)) {
 		fprintf(stderr, "can't have <data> arg with -r\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	/* read address */
 	addr = strtoul(argv[0], &ptr, 0);
 	if (*ptr) {
 		fprintf(stderr, "Bad arg: %s\n", argv[0]);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	/* read size */
 	len = strtoul(argv[1], &ptr, 0);
 	if (*ptr) {
 		fprintf(stderr, "Bad value: %s\n", argv[1]);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	align = addr & 0x03;
 	if (align && argc > 2) {
 		fprintf(stderr, "Can only write starting at long-aligned addresses.\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	/* get can just use utility function, set must copy custom buffer */
@@ -1044,7 +1051,7 @@ dhd_membytes(void *dhd, cmd_t *cmd, char **argv)
 			char *inptr, *outptr;
 			if (patlen & 1) {
 				fprintf(stderr, "Hex (-h) must consist of whole bytes\n");
-				ret = USAGE_ERROR;
+				ret = BCME_USAGE_ERROR;
 				goto exit;
 			}
 
@@ -1056,7 +1063,7 @@ dhd_membytes(void *dhd, cmd_t *cmd, char **argv)
 				if (!isxdigit(n1) || !isxdigit(n2)) {
 					fprintf(stderr, "invalid hex digit %c\n",
 					        (isxdigit(n1) ? n2 : n1));
-					ret = USAGE_ERROR;
+					ret = BCME_USAGE_ERROR;
 					goto exit;
 				}
 				n1 = isdigit(n1) ? (n1 - '0')
@@ -1116,7 +1123,7 @@ dhd_idletime(void *dhd, cmd_t *cmd, char **argv)
 			idletime = strtol(argv[1], &endptr, 0);
 			if (*endptr != '\0') {
 				fprintf(stderr, "invalid number %s\n", argv[1]);
-				err = -1;
+				err = BCME_USAGE_ERROR;
 			}
 		}
 		if ((idletime < 0) && (idletime != DHD_IDLE_IMMEDIATE)) {
@@ -1165,7 +1172,7 @@ dhd_idleclock(void *dhd, cmd_t *cmd, char **argv)
 			idleclock = strtol(argv[1], &endptr, 0);
 			if (*endptr != '\0') {
 				fprintf(stderr, "invalid number %s\n", argv[1]);
-				err = USAGE_ERROR;
+				err = BCME_USAGE_ERROR;
 			}
 		}
 
@@ -1228,7 +1235,7 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 	if (strcmp(argv[0], "srdump") == 0) {
 		if (argc) {
 			fprintf(stderr, "Command srdump doesn't take args\n");
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 		offset = 0;
 		words = SPROM_WORDS;
@@ -1241,16 +1248,16 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 
 		if (!ISALIGNED((uintptr)bufp, sizeof(uint16))) {
 			fprintf(stderr, "Internal error: unaligned word buffer\n");
-			return COMMAND_ERROR;
+			return BCME_ERROR;
 		}
 	} else {
 		if (strcmp(argv[0], "srwrite") != 0) {
 			fprintf(stderr, "Unimplemented sprom command: %s\n", argv[0]);
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 
 		if (argc == 0) {
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		} else if ((argc == 1) ||
 		           ((argc == 2) && ((nocrc = !strcmp(argv[1], "-c"))))) {
 
@@ -1258,7 +1265,7 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 
 			/* determine and validate file size */
 			if ((ret = file_size(fname)) < 0)
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 
 			bytes = ret;
 			offset = 0;
@@ -1266,7 +1273,7 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 
 			if (bytes != 2 * SPROM_WORDS) {
 				fprintf(stderr, "Bad file size\n");
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 			}
 
 			memcpy(bufp, &offset, sizeof(int));
@@ -1276,20 +1283,20 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 
 			if (!ISALIGNED((uintptr)bufp, sizeof(uint16))) {
 				fprintf(stderr, "Internal error: unaligned word buffer\n");
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 			}
 
 			if ((fp = fopen(fname, "rb")) == NULL) {
 				fprintf(stderr, "Could not open %s: %s\n",
 				        fname, strerror(errno));
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 			}
 
 			if (fread((uint16*)bufp, sizeof(uint16), words, fp) != words) {
 				fprintf(stderr, "Could not read %d bytes from %s\n",
 				        words * 2, fname);
 				fclose(fp);
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 			}
 
 			fclose(fp);
@@ -1299,7 +1306,7 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 				fprintf(stderr, "CRC check failed: 0x%02x, should be 0x%02x.\n",
 				        ((uint8*)bufp)[bytes-1],
 				        ~hndcrc8((uint8*)bufp, bytes - 1, CRC8_INIT_VALUE) & 0xff);
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 			}
 
 			ltoh16_buf(bufp, bytes);
@@ -1307,7 +1314,7 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 			offset = strtoul(*++argv, &endptr, 0) * 2;
 			if (*endptr != '\0') {
 				fprintf(stderr, "offset %s is not an integer\n", *argv);
-				return USAGE_ERROR;
+				return BCME_USAGE_ERROR;
 			}
 
 			memcpy(bufp, &offset, sizeof(int));
@@ -1317,18 +1324,18 @@ dhd_sprom(void *dhd, cmd_t *cmd, char **argv)
 
 			if (!ISALIGNED((uintptr)bufp, sizeof(uint16))) {
 				fprintf(stderr, "Internal error: unaligned word buffer\n");
-				return COMMAND_ERROR;
+				return BCME_ERROR;
 			}
 
 			for (words = 0, wordptr = (uint16*)bufp; *++argv; words++) {
 				*wordptr++ = (uint16)strtoul(*argv, &endptr, 0);
 				if (*endptr != '\0') {
 					fprintf(stderr, "value %s is not an integer\n", *argv);
-					return USAGE_ERROR;
+					return BCME_USAGE_ERROR;
 				}
 				if (words > SPROM_WORDS) {
 					fprintf(stderr, "max of %d words\n", SPROM_WORDS);
-					return USAGE_ERROR;
+					return BCME_USAGE_ERROR;
 				}
 			}
 
@@ -1522,7 +1529,7 @@ dhd_verify_file_bytes(void *dhd, uint8 *memblock, int start, uint len)
 	if (ret) {
 		fprintf(stderr, "%s: failed reading %d membytes from 0x%08x\n",
 		__FUNCTION__, len, start);
-		return -1;
+		return ret;
 	}
 
 	src = (uint8 *)memblock;
@@ -1590,13 +1597,10 @@ failed_retry:
 		if (ret) {
 			fprintf(stderr, "%s: error %d on writing %d membytes at 0x%08x\n",
 			        __FUNCTION__, ret, len, start);
-			return -1;
+			return ret;
 		}
 
 		if (verify == TRUE) {
-			if (len & 1)
-				len = ROUNDUP(len, 2);
-
 			if (dhd_verify_file_bytes(dhd, memblock, start, len) != 0) {
 				if (retry++ < 5000)
 				{
@@ -1619,36 +1623,77 @@ static int
 dhd_proptxstatusenable(void *dhd, cmd_t *cmd, char **argv)
 {
 	int flag = 0xdead;
+	int ret;
 
 	if (argv[1]) {
 		flag = atoi(argv[1]);
-		dhd_iovar_setint(dhd, cmd->name, flag);
+		ret = dhd_iovar_setint(dhd, cmd->name, flag);
 	}
 	else {
-		dhd_iovar_getint(dhd, cmd->name, &flag);
-		printf("proptxstatus: %d\n", flag);
+		ret = dhd_iovar_getint(dhd, cmd->name, &flag);
+		if (ret >= 0)
+			printf("proptxstatus: %d\n", flag);
 	}
-	return 0;
+	return ret;
 }
 
 static int
 dhd_proptxstatusmode(void *dhd, cmd_t *cmd, char **argv)
 {
 	int mode = 0xdead;
+	int ret;
 
 	if (argv[1]) {
 		mode = atoi(argv[1]);
-		dhd_iovar_setint(dhd, cmd->name, mode);
+		ret = dhd_iovar_setint(dhd, cmd->name, mode);
 	}
 	else {
-		dhd_iovar_getint(dhd, cmd->name, &mode);
-		printf("proptxstatusmode: %d\n", mode);
+		ret = dhd_iovar_getint(dhd, cmd->name, &mode);
+		if (ret >= 0)
+			printf("proptxstatusmode: %d\n", mode);
 	}
-	return 0;
+	return ret;
 }
+
+static int
+dhd_proptxopt(void *dhd, cmd_t *cmd, char **argv)
+{
+	int flag = 0xdead;
+	int ret;
+
+	if (argv[1]) {
+		flag = atoi(argv[1]);
+		ret = dhd_iovar_setint(dhd, cmd->name, flag);
+	}
+	else {
+		ret = dhd_iovar_getint(dhd, cmd->name, &flag);
+		if (ret >= 0)
+			printf("proptx_opt: %d\n", flag);
+	}
+	return ret;
+}
+
 #endif /* PROP_TXSTATUS */
 
 static int
+dhd_get_ramstart(void *dhd, uint32 *ramstart)
+{
+	int ret;
+	char *ramstart_args[] = {"ramstart", NULL};
+
+	/* Read the bus type the DHD driver is associated to */
+	if ((ret = dhd_var_get(dhd, NULL, ramstart_args)) != BCME_OK) {
+		fprintf(stderr, "%s: error obtaining ramstart\n", __FUNCTION__);
+
+		return ret;
+	}
+
+	*ramstart = *(uint32 *)buf;
+
+	return BCME_OK;
+}
+
+static int
 dhd_download(void *dhd, cmd_t *cmd, char **argv)
 {
 #if !defined(BWL_FILESYSTEM_SUPPORT)
@@ -1659,15 +1704,15 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 	bool verify = FALSE;
 	char *fname = NULL;
 	char *vname = NULL;
-	uint32 start = 0;
+	uint32 start;
 	int ret = 0;
 	int fsize;
 	uint32 bustype;
 	long filepos;
 
 	FILE *fp = NULL;
-	uint32 memsize;
-	char *memszargs[] = { "memsize", NULL };
+	uint32 ramsize;
+	char *memszargs[] = { "ramsize", NULL };
 
 	char *bufp;
 
@@ -1682,6 +1727,9 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 
 	UNUSED_PARAMETER(cmd);
 
+	if ((ret = dhd_get_ramstart(dhd, &start)) != BCME_OK)
+		goto exit;
+
 	/* Parse command-line options */
 	miniopt_init(&opts, "download", "", TRUE);
 
@@ -1788,14 +1836,14 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 
 	if (bustype == BUS_TYPE_SDIO) {
 		if ((ret = dhd_var_get(dhd, NULL, memszargs))) {
-			fprintf(stderr, "%s: error obtaining memsize\n", __FUNCTION__);
+			fprintf(stderr, "%s: error obtaining ramsize\n", __FUNCTION__);
 			goto exit;
 		}
-		memsize = *(uint32*)buf;
+		ramsize = *(uint32*)buf;
 	}
 
 
-	BCM_REFERENCE(memsize);
+	BCM_REFERENCE(ramsize);
 
 	/* do the download reset if not suppressed */
 	if (reset) {
@@ -1805,6 +1853,8 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 			goto exit;
 		}
 	}
+	
+#define RDL_CHUNK	1500  /* size of each dl transfer */
 
 	if (BUS_TYPE_USB == bustype) {
 		/* store the cur pos pointing to base image which should be written */
@@ -1824,10 +1874,9 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 
 
 	/* Load the ram image */
-	if (dhd_load_file_bytes(dhd, cmd, fp, fsize, start, memblock_sz, verify)) {
+	if ((ret = dhd_load_file_bytes(dhd, cmd, fp, fsize, start, memblock_sz, verify))) {
 		fprintf(stderr, "%s: error loading the ramimage at addr 0x%x\n",
 		        __FUNCTION__, start);
-		ret = -1;
 		goto exit;
 	}
 
@@ -1889,7 +1938,6 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 		}
 	}
 	if (embedded_ucode) {
-/* GREG remove */	
 	}
 
 exit:
@@ -1907,13 +1955,13 @@ dhd_dldn(void *dhd, cmd_t *cmd, char **argv)
 	return (-1);
 #else
 	char *fname = NULL;
-	uint32 start = 0;
+	uint32 start;
 	int ret = 0;
 	int fsize;
 	int fd = 0;
 
 	FILE *fp = NULL;
-	uint32 memsize;
+	uint32 ramsize;
 
 	uint len;
 	uint8 memblock[MEMBLOCK];
@@ -1970,11 +2018,11 @@ dhd_dldn(void *dhd, cmd_t *cmd, char **argv)
 		goto exit;
 	}
 
-	memsize = 393216;
+	ramsize = 393216;
 
-	if (memsize && ((uint32)fsize > memsize)) {
+	if (ramsize && ((uint32)fsize > ramsize)) {
 		fprintf(stderr, "%s: file %s too large (%d > %d)\n",
-		        __FUNCTION__, fname, fsize, memsize);
+		        __FUNCTION__, fname, fsize, ramsize);
 		ret = -1;
 		goto exit;
 	}
@@ -1987,6 +2035,9 @@ dhd_dldn(void *dhd, cmd_t *cmd, char **argv)
 		goto exit;
 	}
 
+	if ((ret = dhd_get_ramstart(dhd, &start)) != BCME_OK)
+		goto exit;
+
 	while ((len = fread(memblock, sizeof(uint8), MEMBLOCK, fp))) {
 		if (len < MEMBLOCK && !feof(fp)) {
 			fprintf(stderr, "%s: error reading file %s\n", __FUNCTION__, fname);
@@ -2017,7 +2068,7 @@ exit:
 		fclose(fp);
 
 	if (fd)
-		dhd_set(dhd, DHD_DLDN_END, NULL, 0);
+		ret = dhd_set(dhd, DHD_DLDN_END, NULL, 0);
 
 	return ret;
 #endif /* BWL_FILESYSTEM_SUPPORT */
@@ -2030,13 +2081,13 @@ dhd_upload(void *dhd, cmd_t *cmd, char **argv)
 	return (-1);
 #else
 	char *fname = NULL;
-	uint32 start = 0;
+	uint32 start;
 	uint32 size = 0;
 	int ret = 0;
 
 	FILE *fp;
-	uint32 memsize;
-	char *memszargs[] = { "memsize", NULL };
+	uint32 ramsize;
+	char *memszargs[] = { "ramsize", NULL };
 
 	uint len;
 
@@ -2046,6 +2097,9 @@ dhd_upload(void *dhd, cmd_t *cmd, char **argv)
 	UNUSED_PARAMETER(cmd);
 	UNUSED_PARAMETER(argv);
 
+	if ((ret = dhd_get_ramstart(dhd, &start)) != BCME_OK)
+		goto exit;
+
 	/* Parse command-line options */
 	miniopt_init(&opts, "upload", "", TRUE);
 
@@ -2094,20 +2148,13 @@ dhd_upload(void *dhd, cmd_t *cmd, char **argv)
 	}
 
 	if ((ret = dhd_var_get(dhd, NULL, memszargs))) {
-		fprintf(stderr, "%s: error obtaining memsize\n", __FUNCTION__);
+		fprintf(stderr, "%s: error obtaining ramsize\n", __FUNCTION__);
 		goto exit;
 	}
-	memsize = *(uint32*)buf;
+	ramsize = *(uint32*)buf;
 
-	if (!memsize)
-		memsize = start + size;
-
-	if (start + size > memsize) {
-		fprintf(stderr, "%s: %d bytes at 0x%x exceeds ramsize 0x%x\n",
-		        __FUNCTION__, size, start, memsize);
-		ret = -1;
-		goto exit;
-	}
+	if (!ramsize)
+		ramsize = start + size;
 
 	if ((fp = fopen(fname, "wb")) == NULL) {
 		fprintf(stderr, "%s: Could not open %s: %s\n",
@@ -2118,7 +2165,7 @@ dhd_upload(void *dhd, cmd_t *cmd, char **argv)
 
 	/* default size to full RAM */
 	if (!size)
-		size = memsize - start;
+		size = ramsize - start;
 
 	/* read memory and write to file */
 	while (size) {
@@ -2136,7 +2183,7 @@ dhd_upload(void *dhd, cmd_t *cmd, char **argv)
 			break;
 		}
 
-		if (fwrite(ptr, sizeof(*ptr), len, fp) != len) {
+		if (fwrite(ptr, sizeof(char), len, fp) != len) {
 			fprintf(stderr, "%s: error writing to file %s\n", __FUNCTION__, fname);
 			ret = -1;
 			break;
@@ -2152,6 +2199,332 @@ exit:
 #endif /* BWL_FILESYSTEM_SUPPORT */
 }
 
+#ifdef BWL_FILESYSTEM_SUPPORT
+static int
+dhd_get_debug_info(void *dhd, hndrte_debug_t *debug_info)
+{
+	int i;
+	int ret;
+	int params[2];
+
+	uint32 *buffer;
+	uint32 debug_info_ptr;
+	uint32 ramstart;
+
+	if ((ret = dhd_get_ramstart(dhd, &ramstart)) != BCME_OK)
+		return ret;
+
+	/*
+	 * Different chips have different fixed debug_info_ptrs
+	 * because of different ROM locations/uses.  Try them all looking
+	 * for the magic number.
+	 */
+	for (i = 0; ; i++) {
+		if (debug_info_ptrs[i] == DEBUG_INFO_PTRS_END) {
+			fprintf(stderr, "Error: cannot find pointer to debug_info\n");
+			return -1;
+		}
+
+		params[0] = debug_info_ptrs[i] + ramstart;
+		params[1] = 8;
+		ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&buffer);
+		if ((ret == 0) &&
+		    (*buffer == HNDRTE_DEBUG_PTR_PTR_MAGIC)) {
+			break;
+		}
+	}
+
+	debug_info_ptr = *(buffer + 1);
+	if (debug_info_ptr == 0) {
+		fprintf(stderr, "Error: Debug info pointer is zero\n");
+		return -1;
+	}
+
+	/* Read the area the debuginfoptr points at */
+	params[0] = debug_info_ptr;
+	params[1] = sizeof(hndrte_debug_t);
+	ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&buffer);
+	if (ret) {
+		fprintf(stderr, "%s: failed reading %lu membytes from 0x%08lx\n",
+			__FUNCTION__, (long unsigned) params[1], (long unsigned) params[0]);
+		return ret;
+	}
+
+	memcpy((char *) debug_info, buffer, sizeof(hndrte_debug_t));
+
+	/* Sanity check the area */
+	if ((debug_info->magic != HNDRTE_DEBUG_MAGIC) ||
+	    (debug_info->version != HNDRTE_DEBUG_VERSION)) {
+		fprintf(stderr, "Error: Invalid debug info area\n");
+		return -1;
+	}
+
+	return 0;
+}
+#endif /* BWL_FILESYSTEM_SUPPORT */
+
+static int
+dhd_coredump(void *dhd, cmd_t *cmd, char **argv)
+{
+#if !defined(BWL_FILESYSTEM_SUPPORT)
+	return (-1);
+#else
+	char *fname = NULL;
+	int ret;
+
+	FILE *fp;
+
+	hndrte_debug_t debugInfo;
+
+	miniopt_t opts;
+	int opt_err;
+
+	int params[2];
+	char *ptr;
+
+	unsigned int start;
+	unsigned int size;
+
+	prstatus_t prstatus;
+
+	UNUSED_PARAMETER(cmd);
+	UNUSED_PARAMETER(argv);
+
+	/* Parse command-line options */
+	miniopt_init(&opts, "dump", "", TRUE);
+
+	argv++;
+	while ((opt_err = miniopt(&opts, argv)) != -1) {
+		if (opt_err == 1) {
+			fprintf(stderr, "dump options error\n");
+			ret = -1;
+			goto exit;
+		}
+		argv += opts.consumed;
+
+		if (opts.positional) {
+			if (!fname) {
+				fname = opts.valstr;
+			} else {
+				fprintf(stderr, "dump options error\n");
+				ret = -1;
+				goto exit;
+			}
+		} else if (!opts.opt) {
+			fprintf(stderr, "unrecognized option %s\n", opts.valstr);
+			ret = -1;
+			goto exit;
+		} else {
+			fprintf(stderr, "unrecognized option %c\n", opts.opt);
+			ret = -1;
+			goto exit;
+		}
+	}
+
+	/* validate arguments */
+	if (!fname) {
+		fprintf(stderr, "filename required\n");
+		ret = -1;
+		goto exit;
+	}
+
+	if ((ret = dhd_get_debug_info(dhd, &debugInfo)) < 0)
+		goto exit;
+
+	/* Get the base and size to dump */
+	start = debugInfo.ram_base;
+	size = debugInfo.ram_size;
+
+	/* Get the arm trap area */
+	bzero(&prstatus, sizeof(prstatus_t));
+	if (debugInfo.trap_ptr != 0) {
+		int i;
+		trap_t armtrap;
+		uint32 *reg;
+
+		params[0] = debugInfo.trap_ptr;
+		params[1] = sizeof(trap_t);
+		ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&ptr);
+		if (ret) {
+			fprintf(stderr, "%s: failed reading %lu membytes from 0x%08lx\n",
+				__FUNCTION__, (long unsigned) params[1], (long unsigned) params[0]);
+			goto exit;
+		}
+
+		memcpy((char *) &armtrap, ptr, sizeof(trap_t));
+
+		/* Populate the prstatus */
+		prstatus.si_signo = armtrap.type;
+		reg = &armtrap.r0;
+		for (i = 0; i < 15; i++, reg++) {
+			prstatus.uregs[i] = *reg;
+		}
+		prstatus.uregs[15] = armtrap.epc;
+	}
+
+	if ((fp = fopen(fname, "wb")) == NULL) {
+		fprintf(stderr, "%s: Could not open %s: %s\n",
+		        __FUNCTION__, fname, strerror(errno));
+		ret = -1;
+		goto exit;
+	}
+
+	/* Write the preamble and debug header */
+	fprintf(fp, "Dump starts for version %s FWID 01-%x\n", debugInfo.epivers, debugInfo.fwid);
+	fprintf(fp, "XXXXXXXXXXXXXXXXXXXX");
+	fprintf(fp, "%8.8lX", (long unsigned) sizeof(debugInfo));
+	if (fwrite(&debugInfo, sizeof(unsigned char), sizeof(debugInfo), fp) != sizeof(debugInfo)) {
+		fprintf(stderr, "%s: error writing to file %s\n", __FUNCTION__, fname);
+		ret = -1;
+		fclose(fp);
+		goto exit;
+	}
+
+	/* Write the prstatus */
+	if (fwrite(&prstatus, sizeof(unsigned char), sizeof(prstatus), fp) != sizeof(prstatus)) {
+		fprintf(stderr, "%s: error writing to file %s\n", __FUNCTION__, fname);
+		ret = -1;
+		fclose(fp);
+		goto exit;
+	}
+
+	/* Write the ram size as another sanity check */
+	fprintf(fp, "%8.8X", size);
+
+	/* read memory and write to file */
+	while (size) {
+		int len;
+		len = MIN(MEMBLOCK, size);
+
+		params[0] = start;
+		params[1] = len;
+		ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&ptr);
+		if (ret) {
+			fprintf(stderr, "%s: failed reading %d membytes from 0x%08x\n",
+			        __FUNCTION__, len, start);
+			break;
+		}
+
+		if (fwrite(ptr, sizeof(char), len, fp) != (uint) len) {
+			fprintf(stderr, "%s: error writing to file %s\n", __FUNCTION__, fname);
+			ret = -1;
+			break;
+		}
+
+		start += len;
+		size -= len;
+	}
+
+	fclose(fp);
+exit:
+	return ret;
+#endif /* BWL_FILESYSTEM_SUPPORT */
+}
+
+static int
+dhd_consoledump(void *dhd, cmd_t *cmd, char **argv)
+{
+#if !defined(BWL_FILESYSTEM_SUPPORT)
+	return (-1);
+#else
+	int ret;
+
+	hndrte_debug_t debugInfo;
+
+	miniopt_t opts;
+	int opt_err;
+
+	int params[2];
+	char *ptr;
+
+	unsigned int start;
+	unsigned int size;
+	int len;
+
+	UNUSED_PARAMETER(cmd);
+	UNUSED_PARAMETER(argv);
+
+	/* Parse command-line options */
+	miniopt_init(&opts, "consoledump", "", TRUE);
+
+	argv++;
+	while ((opt_err = miniopt(&opts, argv)) != -1) {
+		if (opt_err == 1) {
+			fprintf(stderr, "dump options error\n");
+			ret = -1;
+			goto exit;
+		}
+		argv += opts.consumed;
+
+		if (!opts.opt) {
+			fprintf(stderr, "unrecognized option %s\n", opts.valstr);
+			ret = -1;
+			goto exit;
+		} else {
+			fprintf(stderr, "unrecognized option %c\n", opts.opt);
+			ret = -1;
+			goto exit;
+		}
+	}
+
+	if ((ret = dhd_get_debug_info(dhd, &debugInfo)) < 0)
+		goto exit;
+
+	if (debugInfo.console <= debugInfo.ram_base) {
+		fprintf(stderr, "%s: console not found\n", __FUNCTION__);
+		ret = -1;
+		goto exit;
+	}
+
+	/* Get the debug console area */
+	params[0] = debugInfo.console;
+	params[1] = sizeof(hndrte_cons_t);
+	ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&ptr);
+	if (ret) {
+		fprintf(stderr, "%s: failed reading %lu membytes from 0x%08lx\n",
+			__FUNCTION__, (long unsigned) params[1], (long unsigned) params[0]);
+		goto exit;
+	}
+
+	if (ptr == NULL) {
+		fprintf(stderr, "%s: console not initialised\n", __FUNCTION__);
+		ret = -1;
+		goto exit;
+	}
+
+	start = (unsigned int)((hndrte_cons_t *)ptr)->log.buf;
+	size = ((hndrte_cons_t *)ptr)->log.buf_size;
+
+	if (start <= debugInfo.ram_base) {
+		fprintf(stderr, "%s: console buffer not initialised\n", __FUNCTION__);
+		ret = -1;
+		goto exit;
+	}
+
+	/* read memory and write to file */
+	while (size > 0) {
+		len = MIN(MEMBLOCK, size);
+
+		params[0] = start;
+		params[1] = len;
+		ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&ptr);
+		if (ret) {
+			fprintf(stderr, "%s: failed reading %d membytes from 0x%08x\n",
+			        __FUNCTION__, len, start);
+			break;
+		}
+
+		printf("%s", ptr);
+
+		start += len;
+		size -= len;
+	}
+
+exit:
+	return ret;
+#endif /* BWL_FILESYSTEM_SUPPORT */
+}
+
 static int
 dhd_logstamp(void *dhd, cmd_t *cmd, char **argv)
 {
@@ -2165,13 +2538,13 @@ dhd_logstamp(void *dhd, cmd_t *cmd, char **argv)
 	argc--; argv++;
 
 	if (argc > 2)
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 
 	if (argc) {
 		valn[0] = strtol(argv[0], &endptr, 0);
 		if (*endptr != '\0') {
 			printf("bad val1: %s\n", argv[0]);
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	}
 
@@ -2179,7 +2552,7 @@ dhd_logstamp(void *dhd, cmd_t *cmd, char **argv)
 		valn[1] = strtol(argv[1], &endptr, 0);
 		if (*endptr != '\0') {
 			printf("bad val2: %s\n", argv[1]);
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	}
 
@@ -2208,29 +2581,29 @@ dhd_sd_reg(void *dhd, cmd_t *cmd, char **argv)
 		argv++;
 		if (argc < 1) {
 			printf("required args: offset [value]\n");
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 
 	} else if (!strcmp(cmd->name, "sd_devreg")) {
 		argv++;
 		if (argc < 2) {
 			printf("required args: func offset [value]\n");
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 
 		sdreg.func = strtoul(*argv++, &endptr, 0);
 		if (*endptr != '\0') {
 			printf("Invalid function number\n");
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	} else {
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	sdreg.offset = strtoul(*argv++, &endptr, 0);
 	if (*endptr != '\0') {
 		printf("Invalid offset value\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	/* third arg: value */
@@ -2238,7 +2611,7 @@ dhd_sd_reg(void *dhd, cmd_t *cmd, char **argv)
 		sdreg.value = strtoul(*argv, &endptr, 0);
 		if (*endptr != '\0') {
 			printf("Invalid value\n");
-			return USAGE_ERROR;
+			return BCME_USAGE_ERROR;
 		}
 	}
 
@@ -2404,19 +2777,19 @@ dhd_var_setint(void *dhd, cmd_t *cmd, char **argv)
 
 	if (cmd->set == -1) {
 		printf("set not defined for %s\n", cmd->name);
-		return COMMAND_ERROR;
+		return BCME_ERROR;
 	}
 
 	if (!*argv) {
 		printf("set: missing arguments\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	varname = *argv++;
 
 	if (!*argv) {
 		printf("set: missing value argument for set of \"%s\"\n", varname);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	val = strtol(*argv, &endptr, 0);
@@ -2424,7 +2797,7 @@ dhd_var_setint(void *dhd, cmd_t *cmd, char **argv)
 		/* not all the value string was parsed by strtol */
 		printf("set: error parsing value \"%s\" as an integer for set of \"%s\"\n",
 			*argv, varname);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	strcpy(buf, varname);
@@ -2453,14 +2826,14 @@ dhd_var_get(void *dhd, cmd_t *cmd, char **argv)
 
 	if (!*argv) {
 		printf("get: missing arguments\n");
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	varname = *argv++;
 
 	if (*argv) {
 		printf("get: error, extra arg \"%s\"\n", *argv);
-		return USAGE_ERROR;
+		return BCME_USAGE_ERROR;
 	}
 
 	strcpy(buf, varname);
@@ -2479,7 +2852,7 @@ dhd_var_getint(void *dhd, cmd_t *cmd, char **argv)
 	int32 val;
 	if (cmd->get == -1) {
 		printf("get not defined for %s\n", cmd->name);
-		return COMMAND_ERROR;
+		return BCME_ERROR;
 	}
 
 	if ((err = dhd_var_get(dhd, cmd, argv)))
@@ -2573,7 +2946,7 @@ dhd_var_void(void *dhd, cmd_t *cmd, char **argv)
 	UNUSED_PARAMETER(argv);
 
 	if (cmd->set < 0)
-		return USAGE_ERROR;
+		return BCME_ERROR;
 
 	return dhd_var_setbuf(dhd, cmd->name, NULL, 0);
 }
@@ -2690,136 +3063,6 @@ dhd_hostreorder_flows(void *dhd, cmd_t *cmd, char **argv)
 }
 
 
-#ifdef WLBTAMP
-
-#define MATCH_OP(op, opstr)	(strlen(op) == strlen(opstr) && strncmp(op, opstr, strlen(op)) == 0)
-
-static int
-wl_HCI_cmd(void *wl, cmd_t *cmd, char **argv)
-{
-	union {
-		char buf[HCI_CMD_PREAMBLE_SIZE + HCI_CMD_DATA_SIZE];
-		uint32 alignme;
-	} cbuf;
-	amp_hci_cmd_t *cpkt = (amp_hci_cmd_t *)&cbuf.buf[0];
-
-	char *op;
-	uint8 plen;
-
-	UNUSED_PARAMETER(cmd);
-
-	if (!*++argv)
-		return USAGE_ERROR;
-
-	/* recognize and encode operations */
-	op = *argv++;
-	if (MATCH_OP(op, "Read_Link_Quality")) {
-		cpkt->opcode = HCI_Read_Link_Quality;
-	} else if (MATCH_OP(op, "Read_Local_AMP_Info")) {
-		cpkt->opcode = HCI_Read_Local_AMP_Info;
-	} else if (MATCH_OP(op, "Read_Local_AMP_ASSOC")) {
-		cpkt->opcode = HCI_Read_Local_AMP_ASSOC;
-	} else if (MATCH_OP(op, "Write_Remote_AMP_ASSOC")) {
-		cpkt->opcode = HCI_Write_Remote_AMP_ASSOC;
-	} else if (MATCH_OP(op, "Create_Physical_Link")) {
-		cpkt->opcode = HCI_Create_Physical_Link;
-	} else if (MATCH_OP(op, "Accept_Physical_Link_Request")) {
-		cpkt->opcode = HCI_Accept_Physical_Link_Request;
-	} else if (MATCH_OP(op, "Disconnect_Physical_Link")) {
-		cpkt->opcode = HCI_Disconnect_Physical_Link;
-	} else if (MATCH_OP(op, "Create_Logical_Link")) {
-		cpkt->opcode = HCI_Create_Logical_Link;
-	} else if (MATCH_OP(op, "Accept_Logical_Link")) {
-		cpkt->opcode = HCI_Accept_Logical_Link;
-	} else if (MATCH_OP(op, "Disconnect_Logical_Link")) {
-		cpkt->opcode = HCI_Disconnect_Logical_Link;
-	} else if (MATCH_OP(op, "Logical_Link_Cancel")) {
-		cpkt->opcode = HCI_Logical_Link_Cancel;
-	} else if (MATCH_OP(op, "Short_Range_Mode")) {
-		cpkt->opcode = HCI_Short_Range_Mode;
-	} else if (MATCH_OP(op, "Read_Connection_Accept_Timeout")) {
-		cpkt->opcode = HCI_Read_Connection_Accept_Timeout;
-	} else if (MATCH_OP(op, "Write_Connection_Accept_Timeout")) {
-		cpkt->opcode = HCI_Write_Connection_Accept_Timeout;
-	} else if (MATCH_OP(op, "Read_Link_Supervision_Timeout")) {
-		cpkt->opcode = HCI_Read_Link_Supervision_Timeout;
-	} else if (MATCH_OP(op, "Write_Link_Supervision_Timeout")) {
-		cpkt->opcode = HCI_Write_Link_Supervision_Timeout;
-	} else if (MATCH_OP(op, "Reset")) {
-		cpkt->opcode = HCI_Reset;
-	} else if (MATCH_OP(op, "Enhanced_Flush")) {
-		cpkt->opcode = HCI_Enhanced_Flush;
-	} else if (MATCH_OP(op, "Read_Best_Effort_Flush_Timeout")) {
-		cpkt->opcode = HCI_Read_Best_Effort_Flush_Timeout;
-	} else if (MATCH_OP(op, "Write_Best_Effort_Flush_Timeout")) {
-		cpkt->opcode = HCI_Write_Best_Effort_Flush_Timeout;
-	} else if (MATCH_OP(op, "Read_Logical_Link_Accept_Timeout")) {
-		cpkt->opcode = HCI_Read_Logical_Link_Accept_Timeout;
-	} else if (MATCH_OP(op, "Write_Logical_Link_Accept_Timeout")) {
-		cpkt->opcode = HCI_Write_Logical_Link_Accept_Timeout;
-	} else if (MATCH_OP(op, "Read_Buffer_Size")) {
-		cpkt->opcode = HCI_Read_Buffer_Size;
-	} else if (MATCH_OP(op, "Read_Data_Block_Size")) {
-		cpkt->opcode = HCI_Read_Data_Block_Size;
-	} else if (MATCH_OP(op, "Set_Event_Mask_Page_2")) {
-		cpkt->opcode = HCI_Set_Event_Mask_Page_2;
-	} else if (MATCH_OP(op, "Flow_Spec_Modify")) {
-		cpkt->opcode = HCI_Flow_Spec_Modify;
-	} else if (MATCH_OP(op, "Read_Local_Version_Info")) {
-		cpkt->opcode = HCI_Read_Local_Version_Info;
-	} else if (MATCH_OP(op, "Read_Local_Supported_Commands")) {
-		cpkt->opcode = HCI_Read_Local_Supported_Commands;
-	} else if (MATCH_OP(op, "Read_Failed_Contact_Counter")) {
-		cpkt->opcode = HCI_Read_Failed_Contact_Counter;
-	} else if (MATCH_OP(op, "Reset_Failed_Contact_Counter")) {
-		cpkt->opcode = HCI_Reset_Failed_Contact_Counter;
-	} else {
-		printf("unsupported HCI command: %s\n", op);
-		return (-1);
-	}
-
-	plen = 0;
-	while (*argv && (plen < HCI_CMD_DATA_SIZE)) {
-		cpkt->parms[plen++] = (uint8)strtol(*argv++, NULL, 0);
-	}
-	cpkt->plen = plen;
-
-	return dhd_var_setbuf(wl, cmd->name, cpkt, HCI_CMD_PREAMBLE_SIZE + plen);
-}
-
-typedef union {
-	uint8 buf[HCI_ACL_DATA_PREAMBLE_SIZE + 2048];
-	uint32 alignme;
-} g_hci_dbuf_t;
-
-static int
-wl_HCI_ACL_data(void *wl, cmd_t *cmd, char **argv)
-{
-	/* Align struct. Also declare static so that large array isn't allocated
-	 * from the stack.
-	 */
-	static g_hci_dbuf_t g_hci_dbuf;
-
-	amp_hci_ACL_data_t *dpkt = (amp_hci_ACL_data_t *)&g_hci_dbuf.buf[0];
-	uint16 dlen;
-
-	if (!*++argv)
-		return USAGE_ERROR;
-
-	/* get logical link handle */
-	dpkt->handle = (HCI_ACL_DATA_BC_FLAGS | HCI_ACL_DATA_PB_FLAGS);
-	dpkt->handle |= (uint16)strtol(*argv++, NULL, 0);
-
-	/* get data */
-	dlen = 0;
-	while (*argv && (dlen < 2048)) {
-		dpkt->data[dlen++] = (uint8)strtol(*argv++, NULL, 0);
-	}
-	dpkt->dlen = dlen;
-
-	return dhd_var_setbuf(wl, cmd->name, dpkt, HCI_ACL_DATA_PREAMBLE_SIZE + dlen);
-}
-#endif /* WLBTAMP */
 
 /* These two utility functions are used by dhdu_linux.c
  * The code is taken from wlu.c.
diff --git a/bcmdhd/dhdutil/dhdu.h b/bcmdhd/dhdutil/dhdu.h
index dbda436..1792029 100644
--- a/bcmdhd/dhdutil/dhdu.h
+++ b/bcmdhd/dhdutil/dhdu.h
@@ -1,7 +1,7 @@
 /*
  * Definitions for DHD command-line utility
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu.h 294362 2011-11-06 22:26:56Z $
+ * $Id: dhdu.h 379386 2013-01-17 07:20:55Z $
  */
 
 #ifndef _dhdu_h_
@@ -46,10 +46,6 @@ struct ipv4_addr;
 int dhd_ether_atoe(const char *a, struct ether_addr *n);
 int dhd_atoip(const char *a, struct ipv4_addr *n);
 
-#define USAGE_ERROR    -1	/* Error code for Usage */
-#define IOCTL_ERROR    -2	/* Error code for ioctl failure */
-#define COMMAND_ERROR  -3	/* Error code for general command failure */
-
 /* integer output format */
 #define INT_FMT_DEC	0	/* signed integer */
 #define INT_FMT_UINT	1	/* unsigned integer */
diff --git a/bcmdhd/dhdutil/dhdu_cmd.h b/bcmdhd/dhdutil/dhdu_cmd.h
index 74c6304..9fb2353 100644
--- a/bcmdhd/dhdutil/dhdu_cmd.h
+++ b/bcmdhd/dhdutil/dhdu_cmd.h
@@ -1,7 +1,7 @@
 /*
  * Command structure for dhd command line utility, copied from wl utility
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/bcmdhd/dhdutil/dhdu_common.h b/bcmdhd/dhdutil/dhdu_common.h
index 6ea2ca2..90d6846 100644
--- a/bcmdhd/dhdutil/dhdu_common.h
+++ b/bcmdhd/dhdutil/dhdu_common.h
@@ -1,7 +1,7 @@
 /*
  * Linux port of dhd command line utility, hacked from wl utility.
  *
- * Copyright (C) 2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu_common.h 308298 2012-01-14 01:35:34Z $
+ * $Id: dhdu_common.h 379386 2013-01-17 07:20:55Z $
  */
 
 /* Common header file for dhdu_linux.c and dhdu_ndis.c */
@@ -46,7 +46,6 @@
 #define SUCCESS 	1
 #define FAIL   		-1
 #define NO_PACKET       -2
-#define SERIAL_PORT_ERR -3
 
 /* Added for debug utility support */
 #define ERR		stderr
diff --git a/bcmdhd/dhdutil/dhdu_linux.c b/bcmdhd/dhdutil/dhdu_linux.c
index 146240f..9e24185 100644
--- a/bcmdhd/dhdutil/dhdu_linux.c
+++ b/bcmdhd/dhdutil/dhdu_linux.c
@@ -1,7 +1,7 @@
 /*
  * Linux port of dhd command line utility, hacked from wl utility.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu_linux.c 308298 2012-01-14 01:35:34Z $
+ * $Id: dhdu_linux.c 378962 2013-01-15 13:18:28Z $
  */
 
 #include <stdio.h>
@@ -68,6 +68,7 @@ typedef u_int8_t u8;
 #include <netinet/in.h>
 #include <dhdioctl.h>
 #include "dhdu_common.h"
+#include "dhdu_nl80211.h"
 
 char *av0;
 static int rwl_os_type = LINUX_OS;
@@ -86,23 +87,66 @@ dhd_find_cmd(char* name)
 }
 
 static void
-syserr(char *s)
+syserr(const char *s)
 {
-	fprintf(stderr, "%s: ", dhdu_av0);
+	fprintf(stderr, "%s: ", av0);
 	perror(s);
 	exit(errno);
 }
 
+#ifdef NL80211
+static int __dhd_driver_io(void *dhd, dhd_ioctl_t *ioc)
+{
+	struct dhd_netlink_info dhd_nli;
+	struct ifreq *ifr = (struct ifreq *)dhd;
+	int ret = 0;
+
+	dhd_nli.ifidx = if_nametoindex(ifr->ifr_name);
+	if (!dhd_nli.ifidx) {
+		fprintf(stderr, "invalid device %s\n", ifr->ifr_name);
+		return BCME_IOCTL_ERROR;
+	}
+
+	if (dhd_nl_sock_connect(&dhd_nli) < 0)
+		syserr("socket");
+
+	ret = dhd_nl_do_testmode(&dhd_nli, ioc);
+	dhd_nl_sock_disconnect(&dhd_nli);
+	return ret;
+}
+#else
+static int __dhd_driver_io(void *dhd, dhd_ioctl_t *ioc)
+{
+	struct ifreq *ifr = (struct ifreq *)dhd;
+	int s;
+	int ret = 0;
+
+	/* pass ioctl data */
+	ifr->ifr_data = (caddr_t)ioc;
+
+	/* open socket to kernel */
+	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
+		syserr("socket");
+
+	ret = ioctl(s, SIOCDEVPRIVATE, ifr);
+	if (ret < 0 && errno != EAGAIN)
+		syserr(__FUNCTION__);
+
+	/* cleanup */
+	close(s);
+	return ret;
+}
+#endif /* NL80211 */
+
 /* This function is called by ioctl_setinformation_fe or ioctl_queryinformation_fe
  * for executing  remote commands or local commands
  */
 static int
 dhd_ioctl(void *dhd, int cmd, void *buf, int len, bool set)
 {
-	struct ifreq *ifr = (struct ifreq *)dhd;
 	dhd_ioctl_t ioc;
 	int ret = 0;
-	int s;
+
 	/* By default try to execute wl commands */
 	int driver_magic = WLC_IOCTL_MAGIC;
 	int get_magic = WLC_GET_MAGIC;
@@ -117,26 +161,16 @@ dhd_ioctl(void *dhd, int cmd, void *buf, int len, bool set)
 		get_magic = DHD_GET_MAGIC;
 	}
 
-	/* open socket to kernel */
-	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
-		syserr("socket");
-
 	/* do it */
 	ioc.cmd = cmd;
 	ioc.buf = buf;
 	ioc.len = len;
 	ioc.set = set;
 	ioc.driver = driver_magic;
-	ifr->ifr_data = (caddr_t) &ioc;
 
-	if ((ret = ioctl(s, SIOCDEVPRIVATE, ifr)) < 0) {
-		if (cmd != get_magic) {
-			ret = IOCTL_ERROR;
-		}
-	}
-
-	/* cleanup */
-	close(s);
+	ret = __dhd_driver_io(dhd, &ioc);
+	if (ret < 0 && cmd != get_magic)
+		ret = BCME_IOCTL_ERROR;
 	return ret;
 }
 
@@ -174,9 +208,8 @@ dhd_get_dev_type(char *name, void *buf, char *type)
 	strncpy(ifr.ifr_name, name, IFNAMSIZ);
 	if ((ret = ioctl(s, SIOCETHTOOL, &ifr)) < 0) {
 
-		/* print a good diagnostic if not superuser */
-		if (errno == EPERM)
-			syserr("dhd_get_dev_type");
+		if (errno != EAGAIN)
+			syserr(__FUNCTION__);
 
 		*(char *)buf = '\0';
 	}
@@ -319,7 +352,7 @@ ioctl_queryinformation_fe(void *wl, int cmd, void* input_buf, int *input_len)
 			(unsigned long*)input_len, 0, RDHD_GET_IOCTL);
 	}
 #else /* RWL_ENABLE */
-	return IOCTL_ERROR;
+	return BCME_IOCTL_ERROR;
 #endif /* RWL_ENABLE */
 }
 
@@ -338,7 +371,7 @@ ioctl_setinformation_fe(void *wl, int cmd, void* buf, int *len)
 
 	}
 #else /* RWL_ENABLE */
-	return IOCTL_ERROR;
+	return BCME_IOCTL_ERROR;
 #endif /* RWL_ENABLE */
 }
 
@@ -355,11 +388,11 @@ wl_get(void *wl, int cmd, void *buf, int len)
 	} else {
 		error = (int)ioctl_queryinformation_fe(wl, cmd, buf, &len);
 	}
-	if (error == SERIAL_PORT_ERR)
-		return SERIAL_PORT_ERR;
+	if (error == BCME_SERIAL_PORT_ERR)
+		return BCME_SERIAL_PORT_ERR;
 
 	if (error != 0)
-		return IOCTL_ERROR;
+		return BCME_IOCTL_ERROR;
 
 	return error;
 }
@@ -379,11 +412,11 @@ wl_set(void *wl, int cmd, void *buf, int len)
 		error = (int)ioctl_setinformation_fe(wl, cmd, buf, &len);
 	}
 
-	if (error == SERIAL_PORT_ERR)
-		return SERIAL_PORT_ERR;
+	if (error == BCME_SERIAL_PORT_ERR)
+		return BCME_SERIAL_PORT_ERR;
 
 	if (error != 0) {
-		return IOCTL_ERROR;
+		return BCME_IOCTL_ERROR;
 	}
 	return error;
 }
@@ -506,7 +539,7 @@ main(int argc, char **argv)
 #ifdef RWL_ENABLE
 	if (*argv) {
 		err = process_args(&ifr, argv);
-		if ((err == SERIAL_PORT_ERR) && (remote_type == REMOTE_DONGLE)) {
+		if ((err == BCME_SERIAL_PORT_ERR) && (remote_type == REMOTE_DONGLE)) {
 			DPRINT_ERR(ERR, "\n Retry again\n");
 			err = process_args((struct ifreq*)&ifr, argv);
 		}
@@ -558,17 +591,24 @@ process_args(struct ifreq* ifr, char **argv)
 		    break;
 
 		if (remote_type == NO_REMOTE) {
-		/* use default interface */
+			int ret;
+
+			/* use default interface */
 			if (!ifr->ifr_name[0])
 				dhd_find(ifr, "dhd");
 			/* validate the interface */
-			if (!ifr->ifr_name[0] || dhd_check((void *)ifr)) {
-			if (strcmp("dldn", *argv) != 0) {
-				fprintf(stderr, "%s: dhd driver adapter not found\n", av0);
-				exit(BCME_ERROR);
+			if (!ifr->ifr_name[0]) {
+				if (strcmp("dldn", *argv) != 0) {
+					exit(ENXIO);
+					syserr("interface");
+				}
+			}
+			if ((ret = dhd_check((void *)ifr)) != 0) {
+				if (strcmp("dldn", *argv) != 0) {
+					errno = -ret;
+					syserr("dhd_check");
 				}
 			}
-
 		}
 		/* search for command */
 		cmd = dhd_find_cmd(*argv);
@@ -593,9 +633,9 @@ process_args(struct ifreq* ifr, char **argv)
 		}
 	} else if (!cmd)
 		dhd_usage(NULL);
-	else if (err == USAGE_ERROR)
+	else if (err == BCME_USAGE_ERROR)
 		dhd_cmd_usage(cmd);
-	else if (err == IOCTL_ERROR)
+	else if (err == BCME_IOCTL_ERROR)
 		dhd_printlasterror((void *) ifr);
 
 	return err;
diff --git a/bcmdhd/dhdutil/dhdu_nl80211.c b/bcmdhd/dhdutil/dhdu_nl80211.c
new file mode 100644
index 0000000..8e681f8
--- /dev/null
+++ b/bcmdhd/dhdutil/dhdu_nl80211.c
@@ -0,0 +1,138 @@
+/*
+ * nl80211 linux driver interface.
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: $
+ */
+#include <errno.h>
+#include <linux/nl80211.h>
+#include <dhdioctl.h>
+#include "dhdu_nl80211.h"
+
+/* libnl 1.x compatibility code */
+#if !defined(CONFIG_LIBNL20) && !defined(CONFIG_LIBNL30)
+static inline struct nl_handle *nl_socket_alloc(void)
+{
+	return nl_handle_alloc();
+}
+
+static inline void nl_socket_free(struct nl_sock *h)
+{
+	nl_handle_destroy(h);
+}
+#endif /* CONFIG_LIBNL20 && CONFIG_LIBNL30 */
+
+static int dhd_nl_error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err, void *arg)
+{
+	int *ret = arg;
+	*ret = err->error;
+	return NL_STOP;
+}
+
+static int dhd_nl_finish_handler(struct nl_msg *msg, void *arg)
+{
+	int *ret = arg;
+	*ret = 0;
+	return NL_SKIP;
+}
+
+static int dhd_nl_ack_handler(struct nl_msg *msg, void *arg)
+{
+	int *ret = arg;
+	*ret = 0;
+	return NL_STOP;
+}
+
+static int dhd_nl_valid_handler(struct nl_msg *msg, void *arg)
+{
+	return NL_SKIP;
+}
+
+int dhd_nl_sock_connect(struct dhd_netlink_info *dhd_nli)
+{
+	dhd_nli->nl = nl_socket_alloc();
+	if (dhd_nli->nl == NULL)
+		return -1;
+
+	if (genl_connect(dhd_nli->nl) < 0) {
+		fprintf(stderr, "netlink connection failed\n");
+		goto err;
+	}
+
+	dhd_nli->nl_id = genl_ctrl_resolve(dhd_nli->nl, "nl80211");
+	if (dhd_nli->nl_id < 0) {
+		fprintf(stderr, "'nl80211' netlink not found\n");
+		goto err;
+	}
+
+	dhd_nli->cb = nl_cb_alloc(NL_CB_DEBUG);
+	if (dhd_nli->cb == NULL)
+		goto err;
+
+	nl_socket_set_cb(dhd_nli->nl, dhd_nli->cb);
+	return 0;
+
+err:
+	nl_cb_put(dhd_nli->cb);
+	nl_socket_free(dhd_nli->nl);
+	fprintf(stderr, "nl80211 connection failed\n");
+	return -1;
+}
+
+void dhd_nl_sock_disconnect(struct dhd_netlink_info *dhd_nli)
+{
+	nl_cb_put(dhd_nli->cb);
+	nl_socket_free(dhd_nli->nl);
+}
+
+int dhd_nl_do_testmode(struct dhd_netlink_info *dhd_nli, dhd_ioctl_t *ioc)
+{
+	struct nl_msg *msg;
+	int err;
+
+	msg = nlmsg_alloc();
+	if (msg == NULL)
+		return -ENOMEM;
+
+	/* fill testmode message */
+	genlmsg_put(msg, 0, 0, dhd_nli->nl_id, 0, 0,
+		NL80211_CMD_TESTMODE, 0);
+	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dhd_nli->ifidx);
+	NLA_PUT(msg, NL80211_ATTR_TESTDATA, sizeof(*ioc), ioc);
+
+	err = nl_send_auto_complete(dhd_nli->nl, msg);
+	if (err < 0)
+		goto out;
+
+	err = 1;
+	nl_cb_err(dhd_nli->cb, NL_CB_CUSTOM, dhd_nl_error_handler, &err);
+	nl_cb_set(dhd_nli->cb, NL_CB_ACK, NL_CB_CUSTOM,
+		dhd_nl_ack_handler, &err);
+	nl_cb_set(dhd_nli->cb, NL_CB_FINISH, NL_CB_CUSTOM,
+		dhd_nl_finish_handler, &err);
+	nl_cb_set(dhd_nli->cb, NL_CB_VALID, NL_CB_CUSTOM,
+		dhd_nl_valid_handler, &err);
+	while (err > 0)
+		nl_recvmsgs(dhd_nli->nl, dhd_nli->cb);
+out:
+	nlmsg_free(msg);
+	return err;
+
+nla_put_failure:
+	fprintf(stderr, "setting netlink attribute failed\n");
+	err = -EFAULT;
+	goto out;
+}
diff --git a/bcmdhd/dhdutil/dhdu_nl80211.h b/bcmdhd/dhdutil/dhdu_nl80211.h
new file mode 100644
index 0000000..49e13c6
--- /dev/null
+++ b/bcmdhd/dhdutil/dhdu_nl80211.h
@@ -0,0 +1,50 @@
+/*
+ * Definitions for DHD nl80211 driver interface.
+ *
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: $
+ */
+
+#ifndef DHDU_NL80211_H_
+#define DHDU_NL80211_H_
+
+#ifdef NL80211
+
+#include <netlink/genl/genl.h>
+#include <netlink/genl/family.h>
+#include <netlink/genl/ctrl.h>
+
+/* libnl 1.x compatibility code */
+#if !defined(CONFIG_LIBNL20) && !defined(CONFIG_LIBNL30)
+#define nl_sock		nl_handle
+#endif
+
+struct dhd_netlink_info
+{
+	struct nl_sock *nl;
+	struct nl_cb *cb;
+	int nl_id;
+	int ifidx;
+};
+
+int dhd_nl_sock_connect(struct dhd_netlink_info *dhd_nli);
+void dhd_nl_sock_disconnect(struct dhd_netlink_info *dhd_nli);
+int dhd_nl_do_testmode(struct dhd_netlink_info *dhd_nli, dhd_ioctl_t *ioc);
+
+#endif /* NL80211 */
+
+#endif /* DHDU_NL80211_H_ */
diff --git a/bcmdhd/dhdutil/include/bcm_cfg.h b/bcmdhd/dhdutil/include/bcm_cfg.h
index 88d41d6..7c10bbd 100644
--- a/bcmdhd/dhdutil/include/bcm_cfg.h
+++ b/bcmdhd/dhdutil/include/bcm_cfg.h
@@ -1,7 +1,7 @@
 /*
  * BCM common config options
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,9 +15,9 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcm_cfg.h 294399 2011-11-07 03:31:22Z $
+ * $Id: bcm_cfg.h 351867 2012-08-21 18:46:16Z $
  */
 
 #ifndef _bcm_cfg_h_
 #define _bcm_cfg_h_
-#endif 
+#endif /* _bcm_cfg_h_ */
diff --git a/bcmdhd/dhdutil/include/bcm_mpool_pub.h b/bcmdhd/dhdutil/include/bcm_mpool_pub.h
index 9f4a332..450cbc1 100644
--- a/bcmdhd/dhdutil/include/bcm_mpool_pub.h
+++ b/bcmdhd/dhdutil/include/bcm_mpool_pub.h
@@ -35,7 +35,7 @@
  *              and instrumentation on top of the heap, without modifying the heap
  *              allocation implementation.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/bcmdhd/dhdutil/include/bcmcdc.h b/bcmdhd/dhdutil/include/bcmcdc.h
index 5d19dab..ab2c84f 100644
--- a/bcmdhd/dhdutil/include/bcmcdc.h
+++ b/bcmdhd/dhdutil/include/bcmcdc.h
@@ -4,7 +4,7 @@
  *
  * Definitions subject to change without notice.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -20,39 +20,39 @@
  *
  * $Id: bcmcdc.h 318308 2012-03-02 02:23:42Z $
  */
-
 #ifndef _bcmcdc_h_
 #define	_bcmcdc_h_
 #include <proto/ethernet.h>
 
 typedef struct cdc_ioctl {
-	uint32 cmd;
-	uint32 len;
-	uint32 flags;
-	uint32 status;
+	uint32 cmd;      /* ioctl command value */
+	uint32 len;      /* lower 16: output buflen; upper 16: input buflen (excludes header) */
+	uint32 flags;    /* flag defns given below */
+	uint32 status;   /* status code returned from the device */
 } cdc_ioctl_t;
 
-
+/* Max valid buffer size that can be sent to the dongle */
 #define CDC_MAX_MSG_SIZE   ETHER_MAX_LEN
 
-
-#define CDCL_IOC_OUTLEN_MASK   0x0000FFFF
+/* len field is divided into input and output buffer lengths */
+#define CDCL_IOC_OUTLEN_MASK   0x0000FFFF  /* maximum or expected response length, */
+					   /* excluding IOCTL header */
 #define CDCL_IOC_OUTLEN_SHIFT  0
-#define CDCL_IOC_INLEN_MASK    0xFFFF0000
+#define CDCL_IOC_INLEN_MASK    0xFFFF0000   /* input buffer length, excluding IOCTL header */
 #define CDCL_IOC_INLEN_SHIFT   16
 
-
-#define CDCF_IOC_ERROR		0x01
-#define CDCF_IOC_SET		0x02
-#define CDCF_IOC_OVL_IDX_MASK	0x3c
-#define CDCF_IOC_OVL_RSV	0x40
-#define CDCF_IOC_OVL		0x80
-#define CDCF_IOC_ACTION_MASK	0xfe
-#define CDCF_IOC_ACTION_SHIFT	1
-#define CDCF_IOC_IF_MASK	0xF000
+/* CDC flag definitions */
+#define CDCF_IOC_ERROR		0x01	/* 0=success, 1=ioctl cmd failed */
+#define CDCF_IOC_SET		0x02	/* 0=get, 1=set cmd */
+#define CDCF_IOC_OVL_IDX_MASK	0x3c	/* overlay region index mask */
+#define CDCF_IOC_OVL_RSV	0x40	/* 1=reserve this overlay region */
+#define CDCF_IOC_OVL		0x80	/* 1=this ioctl corresponds to an overlay */
+#define CDCF_IOC_ACTION_MASK	0xfe	/* SET/GET, OVL_IDX, OVL_RSV, OVL mask */
+#define CDCF_IOC_ACTION_SHIFT	1	/* SET/GET, OVL_IDX, OVL_RSV, OVL shift */
+#define CDCF_IOC_IF_MASK	0xF000	/* I/F index */
 #define CDCF_IOC_IF_SHIFT	12
-#define CDCF_IOC_ID_MASK	0xFFFF0000
-#define CDCF_IOC_ID_SHIFT	16
+#define CDCF_IOC_ID_MASK	0xFFFF0000	/* used to uniquely id an ioctl req/resp pairing */
+#define CDCF_IOC_ID_SHIFT	16		/* # of bits of shift for ID Mask */
 
 #define CDC_IOC_IF_IDX(flags)	(((flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT)
 #define CDC_IOC_ID(flags)	(((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT)
@@ -62,41 +62,47 @@ typedef struct cdc_ioctl {
 #define CDC_SET_IF_IDX(hdr, idx) \
 	((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | ((idx) << CDCF_IOC_IF_SHIFT)))
 
-
+/*
+ * BDC header
+ *
+ *   The BDC header is used on data packets to convey priority across USB.
+ */
 
 struct bdc_header {
-	uint8	flags;			
-	uint8	priority;		
+	uint8	flags;			/* Flags */
+	uint8	priority;		/* 802.1d Priority 0:2 bits, 4:7 USB flow control info */
 	uint8	flags2;
-	uint8	dataOffset;		
+	uint8	dataOffset;		/* Offset from end of BDC header to packet data, in
+					 * 4-byte words.  Leaves room for optional headers.
+					 */
 };
 
 #define	BDC_HEADER_LEN		4
 
+/* flags field bitmap */
+#define BDC_FLAG_80211_PKT	0x01	/* Packet is in 802.11 format (dongle -> host) */
+#define BDC_FLAG_SUM_GOOD	0x04	/* Dongle has verified good RX checksums */
+#define BDC_FLAG_SUM_NEEDED	0x08	/* Dongle needs to do TX checksums: host->device */
+#define BDC_FLAG_EVENT_MSG	0x08	/* Payload contains an event msg: device->host */
+#define BDC_FLAG_VER_MASK	0xf0	/* Protocol version mask */
+#define BDC_FLAG_VER_SHIFT	4	/* Protocol version shift */
 
-#define BDC_FLAG_80211_PKT	0x01	
-#define BDC_FLAG_SUM_GOOD	0x04	
-#define BDC_FLAG_SUM_NEEDED	0x08	
-#define BDC_FLAG_EVENT_MSG	0x08	
-#define BDC_FLAG_VER_MASK	0xf0	
-#define BDC_FLAG_VER_SHIFT	4	
-
-
+/* priority field bitmap */
 #define BDC_PRIORITY_MASK	0x07
-#define BDC_PRIORITY_FC_MASK	0xf0	
-#define BDC_PRIORITY_FC_SHIFT	4	
+#define BDC_PRIORITY_FC_MASK	0xf0	/* flow control info mask */
+#define BDC_PRIORITY_FC_SHIFT	4	/* flow control info shift */
 
-
-#define BDC_FLAG2_IF_MASK	0x0f	
+/* flags2 field bitmap */
+#define BDC_FLAG2_IF_MASK	0x0f	/* interface index (host <-> dongle) */
 #define BDC_FLAG2_IF_SHIFT	0
-#define BDC_FLAG2_FC_FLAG	0x10	
-					
-
-
-#define BDC_PROTO_VER_1		1	
-#define BDC_PROTO_VER		2	
+#define BDC_FLAG2_FC_FLAG	0x10	/* flag to indicate if pkt contains */
+					/* FLOW CONTROL info only */
 
+/* version numbers */
+#define BDC_PROTO_VER_1		1	/* Old Protocol version */
+#define BDC_PROTO_VER		2	/* Protocol version */
 
+/* flags2.if field access macros */
 #define BDC_GET_IF_IDX(hdr) \
 	((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
 #define BDC_SET_IF_IDX(hdr, idx) \
@@ -117,4 +123,4 @@ struct bdc_header {
 	((hdr)->flags = (((hdr)->flags & ~BDC_FLAG_PAD_MASK) | \
 	(((idx) & BDC_FLAG_PAD_IDX) << BDC_FLAG_PAD_SHIFT)))
 
-#endif
+#endif /* _bcmcdc_h_ */
diff --git a/bcmdhd/dhdutil/include/bcmdefs.h b/bcmdhd/dhdutil/include/bcmdefs.h
index 44634a1..5cb5df3 100644
--- a/bcmdhd/dhdutil/include/bcmdefs.h
+++ b/bcmdhd/dhdutil/include/bcmdefs.h
@@ -1,7 +1,7 @@
 /*
  * Misc system wide definitions
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,25 +15,38 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmdefs.h 316830 2012-02-23 20:29:22Z $
+ * $Id: bcmdefs.h 381895 2013-01-30 07:06:40Z $
  */
 
 #ifndef	_bcmdefs_h_
 #define	_bcmdefs_h_
 
+/*
+ * One doesn't need to include this file explicitly, gets included automatically if
+ * typedefs.h is included.
+ */
 
-
-
+/* Use BCM_REFERENCE to suppress warnings about intentionally-unused function
+ * arguments or local variables.
+ */
 #define BCM_REFERENCE(data)	((void)(data))
 
-
+/* Compile-time assert can be used in place of ASSERT if the expression evaluates
+ * to a constant at compile time.
+ */
 #define STATIC_ASSERT(expr) { \
-	 \
+	/* Make sure the expression is constant. */ \
 	typedef enum { _STATIC_ASSERT_NOT_CONSTANT = (expr) } _static_assert_e; \
-	 \
+	/* Make sure the expression is true. */ \
 	typedef char STATIC_ASSERT_FAIL[(expr) ? 1 : -1]; \
 }
 
+/* Reclaiming text and data :
+ * The following macros specify special linker sections that can be reclaimed
+ * after a system is considered 'up'.
+ * BCMATTACHFN is also used for detach functions (it's not worth having a BCMDETACHFN,
+ * as in most cases, the attach function calls the detach function to clean up on error).
+ */
 
 #define bcmreclaimed 		0
 #define _data	_data
@@ -46,13 +59,23 @@
 #define	BCMNMIATTACHFN(_fn)	_fn
 #define	BCMNMIATTACHDATA(_data)	_data
 #define CONST	const
+#if defined(__ARM_ARCH_7A__)
+#define BCM47XX_CA9
+#else
+#undef BCM47XX_CA9
+#endif
 #ifndef BCMFASTPATH
+#if defined(BCM47XX_CA9)
+#define BCMFASTPATH		__attribute__ ((__section__ (".text.fastpath")))
+#define BCMFASTPATH_HOST	__attribute__ ((__section__ (".text.fastpath_host")))
+#else
 #define BCMFASTPATH
 #define BCMFASTPATH_HOST
-#endif 
-
+#endif
+#endif /* BCMFASTPATH */
 
 
+/* Put some library data/code into ROM to reduce RAM requirements */
 #define _data	_data
 #define BCMROMDAT_NAME(_data)	_data
 #define _fn		_fn
@@ -63,24 +86,24 @@
 #define BCMROMDAT_APATCH(data)
 #define BCMROMDAT_SPATCH(data)
 
-
-#define	SI_BUS			0
-#define	PCI_BUS			1
-#define	PCMCIA_BUS		2
-#define SDIO_BUS		3
-#define JTAG_BUS		4
-#define USB_BUS			5
-#define SPI_BUS			6
-#define RPC_BUS			7
-
-
+/* Bus types */
+#define	SI_BUS			0	/* SOC Interconnect */
+#define	PCI_BUS			1	/* PCI target */
+#define	PCMCIA_BUS		2	/* PCMCIA target */
+#define SDIO_BUS		3	/* SDIO target */
+#define JTAG_BUS		4	/* JTAG */
+#define USB_BUS			5	/* USB (does not support R/W REG) */
+#define SPI_BUS			6	/* gSPI target */
+#define RPC_BUS			7	/* RPC target */
+
+/* Allows size optimization for single-bus image */
 #ifdef BCMBUSTYPE
 #define BUSTYPE(bus) 	(BCMBUSTYPE)
 #else
 #define BUSTYPE(bus) 	(bus)
 #endif
 
-
+/* Allows size optimization for single-backplane image */
 #ifdef BCMCHIPTYPE
 #define CHIPTYPE(bus) 	(BCMCHIPTYPE)
 #else
@@ -88,7 +111,7 @@
 #endif
 
 
-
+/* Allows size optimization for SPROM support */
 #if defined(BCMSPROMBUS)
 #define SPROMBUS	(BCMSPROMBUS)
 #elif defined(SI_PCMCIA_SROM)
@@ -97,7 +120,7 @@
 #define SPROMBUS	(PCI_BUS)
 #endif
 
-
+/* Allows size optimization for single-chip image */
 #ifdef BCMCHIPID
 #define CHIPID(chip)	(BCMCHIPID)
 #else
@@ -110,15 +133,15 @@
 #define CHIPREV(rev)	(rev)
 #endif
 
+/* Defines for DMA Address Width - Shared between OSL and HNDDMA */
+#define DMADDR_MASK_32 0x0		/* Address mask for 32-bits */
+#define DMADDR_MASK_30 0xc0000000	/* Address mask for 30-bits */
+#define DMADDR_MASK_0  0xffffffff	/* Address mask for 0-bits (hi-part) */
 
-#define DMADDR_MASK_32 0x0
-#define DMADDR_MASK_30 0xc0000000
-#define DMADDR_MASK_0  0xffffffff
-
-#define	DMADDRWIDTH_30  30
-#define	DMADDRWIDTH_32  32
-#define	DMADDRWIDTH_63  63
-#define	DMADDRWIDTH_64  64
+#define	DMADDRWIDTH_30  30 /* 30-bit addressing capability */
+#define	DMADDRWIDTH_32  32 /* 32-bit addressing capability */
+#define	DMADDRWIDTH_63  63 /* 64-bit addressing capability */
+#define	DMADDRWIDTH_64  64 /* 64-bit addressing capability */
 
 #ifdef BCMDMA64OSL
 typedef struct {
@@ -147,9 +170,9 @@ typedef unsigned long dmaaddr_t;
 	do { \
 		(_pa) = (_val);			\
 	} while (0)
-#endif
-
+#endif /* BCMDMA64OSL */
 
+/* One physical DMA segment */
 typedef struct  {
 	dmaaddr_t addr;
 	uint32	  length;
@@ -159,28 +182,42 @@ typedef struct  {
 
 
 typedef struct {
-	void *oshdmah;
-	uint origsize;
+	void *oshdmah; /* Opaque handle for OSL to store its information */
+	uint origsize; /* Size of the virtual packet */
 	uint nsegs;
 	hnddma_seg_t segs[MAX_DMA_SEGS];
 } hnddma_seg_map_t;
 
 
-
+/* packet headroom necessary to accommodate the largest header in the system, (i.e TXOFF).
+ * By doing, we avoid the need  to allocate an extra buffer for the header when bridging to WL.
+ * There is a compile time check in wlc.c which ensure that this value is at least as big
+ * as TXOFF. This value is used in dma_rxfill (hnddma.c).
+ */
 
 #if defined(BCM_RPC_NOCOPY) || defined(BCM_RCP_TXNOCOPY)
-
-#define BCMEXTRAHDROOM 220
+/* add 40 bytes to allow for extra RPC header and info  */
+#define BCMEXTRAHDROOM 260
+#else /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY */
+#if defined(BCM47XX_CA9)
+#define BCMEXTRAHDROOM 224
 #else
-#define BCMEXTRAHDROOM 172
-#endif
-
+#define BCMEXTRAHDROOM 204
+#endif /* linux && BCM47XX_CA9 */
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY */
 
+/* Packet alignment for most efficient SDIO (can change based on platform) */
 #ifndef SDALIGN
 #define SDALIGN	32
 #endif
 
-
+/* Headroom required for dongle-to-host communication.  Packets allocated
+ * locally in the dongle (e.g. for CDC ioctls or RNDIS messages) should
+ * leave this much room in front for low-level message headers which may
+ * be needed to get across the dongle bus to the host.  (These messages
+ * don't go over the network, so room for the full WL header above would
+ * be a waste.).
+*/
 #define BCMDONGLEHDRSZ 12
 #define BCMDONGLEPADSZ 16
 
@@ -194,9 +231,18 @@ typedef struct {
 
 #if defined(BCMASSERT_LOG)
 #define BCMASSERT_SUPPORT
-#endif
-
+#endif 
 
+/* Macros for doing definition and get/set of bitfields
+ * Usage example, e.g. a three-bit field (bits 4-6):
+ *    #define <NAME>_M	BITFIELD_MASK(3)
+ *    #define <NAME>_S	4
+ * ...
+ *    regval = R_REG(osh, &regs->regfoo);
+ *    field = GFIELD(regval, <NAME>);
+ *    regval = SFIELD(regval, <NAME>, 1);
+ *    W_REG(osh, &regs->regfoo, regval);
+ */
 #define BITFIELD_MASK(width) \
 		(((unsigned)1 << (width)) - 1)
 #define GFIELD(val, field) \
@@ -205,27 +251,28 @@ typedef struct {
 		(((val) & (~(field ## _M << field ## _S))) | \
 		 ((unsigned)(bits) << field ## _S))
 
-
+/* define BCMSMALL to remove misc features for memory-constrained environments */
 #ifdef BCMSMALL
 #undef	BCMSPACE
-#define bcmspace	FALSE
+#define bcmspace	FALSE	/* if (bcmspace) code is discarded */
 #else
 #define	BCMSPACE
-#define bcmspace	TRUE
+#define bcmspace	TRUE	/* if (bcmspace) code is retained */
 #endif
 
-
+/* Max. nvram variable table size */
 #define	MAXSZ_NVRAM_VARS	4096
 
 
+/* Max size for reclaimable NVRAM array */
 #ifdef DL_NVRAM
 #define NVRAM_ARRAY_MAXSIZE	DL_NVRAM
 #else
 #define NVRAM_ARRAY_MAXSIZE	MAXSZ_NVRAM_VARS
-#endif 
+#endif /* DL_NVRAM */
 
 #ifdef BCMUSBDEV_ENABLED
 extern uint32 gFWID;
 #endif
 
-#endif 
+#endif /* _bcmdefs_h_ */
diff --git a/bcmdhd/dhdutil/include/bcmdevs.h b/bcmdhd/dhdutil/include/bcmdevs.h
index 27b25a4..2526d12 100644
--- a/bcmdhd/dhdutil/include/bcmdevs.h
+++ b/bcmdhd/dhdutil/include/bcmdevs.h
@@ -1,8 +1,8 @@
 /*
  * Broadcom device-specific manifest constants.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,14 +15,13 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmdevs.h 329854 2012-04-27 01:42:28Z $
+ * $Id: bcmdevs.h 387183 2013-02-24 07:42:07Z $
  */
 
-
 #ifndef	_BCMDEVS_H
 #define	_BCMDEVS_H
 
-
+/* PCI vendor IDs */
 #define	VENDOR_EPIGRAM		0xfeda
 #define	VENDOR_BROADCOM		0x14e4
 #define	VENDOR_3COM		0x10b7
@@ -33,20 +32,20 @@
 #define	VENDOR_HP		0x103c
 #define	VENDOR_HP_COMPAQ	0x0e11
 #define	VENDOR_APPLE		0x106b
-#define VENDOR_SI_IMAGE		0x1095		
-#define VENDOR_BUFFALO		0x1154		
-#define VENDOR_TI		0x104c		
-#define VENDOR_RICOH		0x1180		
+#define VENDOR_SI_IMAGE		0x1095		/* Silicon Image, used by Arasan SDIO Host */
+#define VENDOR_BUFFALO		0x1154		/* Buffalo vendor id */
+#define VENDOR_TI		0x104c		/* Texas Instruments */
+#define VENDOR_RICOH		0x1180		/* Ricoh */
 #define VENDOR_JMICRON		0x197b
 
 
-
+/* PCMCIA vendor IDs */
 #define	VENDOR_BROADCOM_PCMCIA	0x02d0
 
-
+/* SDIO vendor IDs */
 #define	VENDOR_BROADCOM_SDIO	0x00BF
 
-
+/* DONGLE VID/PIDs */
 #define BCM_DNGL_VID		0x0a5c
 #define BCM_DNGL_BL_PID_4328	0xbd12
 #define BCM_DNGL_BL_PID_4322	0xbd13
@@ -58,402 +57,497 @@
 #define BCM_DNGL_BL_PID_43239   0xbd1b
 #define BCM_DNGL_BL_PID_4324	0xbd1c
 #define BCM_DNGL_BL_PID_4360	0xbd1d
+#define BCM_DNGL_BL_PID_43143	0xbd1e
+#define BCM_DNGL_BL_PID_43242	0xbd1f
+#define BCM_DNGL_BL_PID_43342	0xbd21
+#define BCM_DNGL_BL_PID_4335	0xbd20
+#define BCM_DNGL_BL_PID_4350	0xbd23
+#define BCM_DNGL_BL_PID_43341	0xbd22
 
 #define BCM_DNGL_BDC_PID	0x0bdc
 #define BCM_DNGL_JTAG_PID	0x4a44
 
+/* HW USB BLOCK [CPULESS USB] PIDs */
 #define BCM_HWUSB_PID_43239     43239
 
-
-#define	BCM4210_DEVICE_ID	0x1072		
-#define	BCM4230_DEVICE_ID	0x1086		
-#define	BCM4401_ENET_ID		0x170c		
-#define	BCM3352_DEVICE_ID	0x3352		
-#define	BCM3360_DEVICE_ID	0x3360		
+/* PCI Device IDs */
+#define	BCM4210_DEVICE_ID	0x1072		/* never used */
+#define	BCM4230_DEVICE_ID	0x1086		/* never used */
+#define	BCM4401_ENET_ID		0x170c		/* 4401b0 production enet cards */
+#define	BCM3352_DEVICE_ID	0x3352		/* bcm3352 device id */
+#define	BCM3360_DEVICE_ID	0x3360		/* bcm3360 device id */
 #define	BCM4211_DEVICE_ID	0x4211
 #define	BCM4231_DEVICE_ID	0x4231
-#define	BCM4303_D11B_ID		0x4303		
-#define	BCM4311_D11G_ID		0x4311		
-#define	BCM4311_D11DUAL_ID	0x4312		
-#define	BCM4311_D11A_ID		0x4313		
-#define	BCM4328_D11DUAL_ID	0x4314		
-#define	BCM4328_D11G_ID		0x4315		
-#define	BCM4328_D11A_ID		0x4316		
-#define	BCM4318_D11G_ID		0x4318		
-#define	BCM4318_D11DUAL_ID	0x4319		
-#define	BCM4318_D11A_ID		0x431a		
-#define	BCM4325_D11DUAL_ID	0x431b		
-#define	BCM4325_D11G_ID		0x431c		
-#define	BCM4325_D11A_ID		0x431d		
-#define	BCM4306_D11G_ID		0x4320		
-#define	BCM4306_D11A_ID		0x4321		
-#define	BCM4306_UART_ID		0x4322		
-#define	BCM4306_V90_ID		0x4323		
-#define	BCM4306_D11DUAL_ID	0x4324		
-#define	BCM4306_D11G_ID2	0x4325		
-#define	BCM4321_D11N_ID		0x4328
-#define	BCM4321_D11N2G_ID	0x4329
-#define	BCM4321_D11N5G_ID	0x432a
-#define BCM4322_D11N_ID		0x432b
-#define BCM4322_D11N2G_ID	0x432c
-#define BCM4322_D11N5G_ID	0x432d
-#define BCM4329_D11N_ID		0x432e
-#define BCM4329_D11N2G_ID	0x432f
-#define BCM4329_D11N5G_ID	0x4330
-#define	BCM4315_D11DUAL_ID	0x4334
-#define	BCM4315_D11G_ID		0x4335
-#define	BCM4315_D11A_ID		0x4336
-#define BCM4319_D11N_ID		0x4337
-#define BCM4319_D11N2G_ID	0x4338
-#define BCM4319_D11N5G_ID	0x4339
-#define BCM43231_D11N2G_ID	0x4340
-#define BCM43221_D11N2G_ID	0x4341
-#define BCM43222_D11N_ID	0x4350
-#define BCM43222_D11N2G_ID	0x4351
-#define BCM43222_D11N5G_ID	0x4352
-#define BCM43224_D11N_ID	0x4353
-#define BCM43224_D11N_ID_VEN1	0x0576
-#define BCM43226_D11N_ID	0x4354
-#define BCM43236_D11N_ID	0x4346
-#define BCM43236_D11N2G_ID	0x4347
-#define BCM43236_D11N5G_ID	0x4348
-#define BCM43225_D11N2G_ID	0x4357
-#define BCM43421_D11N_ID	0xA99D
-#define BCM4313_D11N2G_ID	0x4727
-#define BCM4330_D11N_ID         0x4360
-#define BCM4330_D11N2G_ID       0x4361
-#define BCM4330_D11N5G_ID       0x4362
-#define BCM4336_D11N_ID		0x4343
-#define BCM6362_D11N_ID		0x435f
-#define BCM4331_D11N_ID		0x4331
-#define BCM4331_D11N2G_ID	0x4332
-#define BCM4331_D11N5G_ID	0x4333
-#define BCM43237_D11N_ID	0x4355
-#define BCM43237_D11N5G_ID	0x4356
-#define BCM43227_D11N2G_ID	0x4358
-#define BCM43228_D11N_ID		0x4359
-#define BCM43228_D11N5G_ID	0x435a
-#define BCM43362_D11N_ID	0x4363
-#define BCM43239_D11N_ID	0x4370
-#define BCM4324_D11N_ID		0x4374		
-#define BCM43217_D11N2G_ID	0x43a9		
-#define BCM43131_D11N2G_ID	0x43aa		
-#define BCM4314_D11N2G_ID	0x4364		
-#define BCM43142_D11N2G_ID	0x4365		
-#define BCM4334_D11N_ID		0x4380		
-#define BCM4334_D11N2G_ID	0x4381		
-#define BCM4334_D11N5G_ID	0x4382		
-#define BCM43341_D11N_ID	0x4386		
-#define BCM43341_D11N2G_ID	0x4387		
-#define BCM43341_D11N5G_ID	0x4388		
+#define	BCM4303_D11B_ID		0x4303		/* 4303 802.11b */
+#define	BCM4311_D11G_ID		0x4311		/* 4311 802.11b/g id */
+#define	BCM4311_D11DUAL_ID	0x4312		/* 4311 802.11a/b/g id */
+#define	BCM4311_D11A_ID		0x4313		/* 4311 802.11a id */
+#define	BCM4328_D11DUAL_ID	0x4314		/* 4328/4312 802.11a/g id */
+#define	BCM4328_D11G_ID		0x4315		/* 4328/4312 802.11g id */
+#define	BCM4328_D11A_ID		0x4316		/* 4328/4312 802.11a id */
+#define	BCM4318_D11G_ID		0x4318		/* 4318 802.11b/g id */
+#define	BCM4318_D11DUAL_ID	0x4319		/* 4318 802.11a/b/g id */
+#define	BCM4318_D11A_ID		0x431a		/* 4318 802.11a id */
+#define	BCM4325_D11DUAL_ID	0x431b		/* 4325 802.11a/g id */
+#define	BCM4325_D11G_ID		0x431c		/* 4325 802.11g id */
+#define	BCM4325_D11A_ID		0x431d		/* 4325 802.11a id */
+#define	BCM4306_D11G_ID		0x4320		/* 4306 802.11g */
+#define	BCM4306_D11A_ID		0x4321		/* 4306 802.11a */
+#define	BCM4306_UART_ID		0x4322		/* 4306 uart */
+#define	BCM4306_V90_ID		0x4323		/* 4306 v90 codec */
+#define	BCM4306_D11DUAL_ID	0x4324		/* 4306 dual A+B */
+#define	BCM4306_D11G_ID2	0x4325		/* BCM4306_D11G_ID; INF w/loose binding war */
+#define	BCM4321_D11N_ID		0x4328		/* 4321 802.11n dualband id */
+#define	BCM4321_D11N2G_ID	0x4329		/* 4321 802.11n 2.4Ghz band id */
+#define	BCM4321_D11N5G_ID	0x432a		/* 4321 802.11n 5Ghz band id */
+#define BCM4322_D11N_ID		0x432b		/* 4322 802.11n dualband device */
+#define BCM4322_D11N2G_ID	0x432c		/* 4322 802.11n 2.4GHz device */
+#define BCM4322_D11N5G_ID	0x432d		/* 4322 802.11n 5GHz device */
+#define BCM4329_D11N_ID		0x432e		/* 4329 802.11n dualband device */
+#define BCM4329_D11N2G_ID	0x432f		/* 4329 802.11n 2.4G device */
+#define BCM4329_D11N5G_ID	0x4330		/* 4329 802.11n 5G device */
+#define	BCM4315_D11DUAL_ID	0x4334		/* 4315 802.11a/g id */
+#define	BCM4315_D11G_ID		0x4335		/* 4315 802.11g id */
+#define	BCM4315_D11A_ID		0x4336		/* 4315 802.11a id */
+#define BCM4319_D11N_ID		0x4337		/* 4319 802.11n dualband device */
+#define BCM4319_D11N2G_ID	0x4338		/* 4319 802.11n 2.4G device */
+#define BCM4319_D11N5G_ID	0x4339		/* 4319 802.11n 5G device */
+#define BCM43231_D11N2G_ID	0x4340		/* 43231 802.11n 2.4GHz device */
+#define BCM43221_D11N2G_ID	0x4341		/* 43221 802.11n 2.4GHz device */
+#define BCM43222_D11N_ID	0x4350		/* 43222 802.11n dualband device */
+#define BCM43222_D11N2G_ID	0x4351		/* 43222 802.11n 2.4GHz device */
+#define BCM43222_D11N5G_ID	0x4352		/* 43222 802.11n 5GHz device */
+#define BCM43224_D11N_ID	0x4353		/* 43224 802.11n dualband device */
+#define BCM43224_D11N_ID_VEN1	0x0576		/* Vendor specific 43224 802.11n db device */
+#define BCM43226_D11N_ID	0x4354		/* 43226 802.11n dualband device */
+#define BCM43236_D11N_ID	0x4346		/* 43236 802.11n dualband device */
+#define BCM43236_D11N2G_ID	0x4347		/* 43236 802.11n 2.4GHz device */
+#define BCM43236_D11N5G_ID	0x4348		/* 43236 802.11n 5GHz device */
+#define BCM43225_D11N2G_ID	0x4357		/* 43225 802.11n 2.4GHz device */
+#define BCM43421_D11N_ID	0xA99D		/* 43421 802.11n dualband device */
+#define BCM4313_D11N2G_ID	0x4727		/* 4313 802.11n 2.4G device */
+#define BCM4330_D11N_ID         0x4360          /* 4330 802.11n dualband device */
+#define BCM4330_D11N2G_ID       0x4361          /* 4330 802.11n 2.4G device */
+#define BCM4330_D11N5G_ID       0x4362          /* 4330 802.11n 5G device */
+#define BCM4336_D11N_ID		0x4343		/* 4336 802.11n 2.4GHz device */
+#define BCM6362_D11N_ID		0x435f		/* 6362 802.11n dualband device */
+#define BCM6362_D11N2G_ID	0x433f		/* 6362 802.11n 2.4Ghz band id */
+#define BCM6362_D11N5G_ID	0x434f		/* 6362 802.11n 5Ghz band id */
+#define BCM4331_D11N_ID		0x4331		/* 4331 802.11n dualband id */
+#define BCM4331_D11N2G_ID	0x4332		/* 4331 802.11n 2.4Ghz band id */
+#define BCM4331_D11N5G_ID	0x4333		/* 4331 802.11n 5Ghz band id */
+#define BCM43237_D11N_ID	0x4355		/* 43237 802.11n dualband device */
+#define BCM43237_D11N5G_ID	0x4356		/* 43237 802.11n 5GHz device */
+#define BCM43227_D11N2G_ID	0x4358		/* 43228 802.11n 2.4GHz device */
+#define BCM43228_D11N_ID	0x4359		/* 43228 802.11n DualBand device */
+#define BCM43228_D11N5G_ID	0x435a		/* 43228 802.11n 5GHz device */
+#define BCM43362_D11N_ID	0x4363		/* 43362 802.11n 2.4GHz device */
+#define BCM43239_D11N_ID	0x4370		/* 43239 802.11n dualband device */
+#define BCM4324_D11N_ID		0x4374		/* 4324 802.11n dualband device */
+#define BCM43217_D11N2G_ID	0x43a9		/* 43217 802.11n 2.4GHz device */
+#define BCM43131_D11N2G_ID	0x43aa		/* 43131 802.11n 2.4GHz device */
+#define BCM4314_D11N2G_ID	0x4364		/* 4314 802.11n 2.4G device */
+#define BCM43142_D11N2G_ID	0x4365		/* 43142 802.11n 2.4G device */
+#define BCM43143_D11N2G_ID	0x4366		/* 43143 802.11n 2.4G device */
+#define BCM4334_D11N_ID		0x4380		/* 4334 802.11n dualband device */
+#define BCM4334_D11N2G_ID	0x4381		/* 4334 802.11n 2.4G device */
+#define BCM4334_D11N5G_ID	0x4382		/* 4334 802.11n 5G device */
+#define BCM43342_D11N_ID	0x4383		/* 43342 802.11n dualband device */
+#define BCM43342_D11N2G_ID	0x4384		/* 43342 802.11n 2.4G device */
+#define BCM43342_D11N5G_ID	0x4385		/* 43342 802.11n 5G device */
+#define BCM43341_D11N_ID	0x4386		/* 43341 802.11n dualband device */
+#define BCM43341_D11N2G_ID	0x4387		/* 43341 802.11n 2.4G device */
+#define BCM43341_D11N5G_ID	0x4388		/* 43341 802.11n 5G device */
 #define BCM4360_D11AC_ID	0x43a0
 #define BCM4360_D11AC2G_ID	0x43a1
 #define BCM4360_D11AC5G_ID	0x43a2
+#define BCM4335_D11AC_ID	0x43ae
+#define BCM4335_D11AC2G_ID	0x43af
+#define BCM4335_D11AC5G_ID	0x43b0
+#define BCM4352_D11AC_ID	0x43b1		/* 4352 802.11ac dualband device */
+#define BCM4352_D11AC2G_ID	0x43b2		/* 4352 802.11ac 2.4G device */
+#define BCM4352_D11AC5G_ID	0x43b3		/* 4352 802.11ac 5G device */
 
-
+/* PCI Subsystem ID */
 #define BCM943228HMB_SSID_VEN1	0x0607
 #define BCM94313HMGBL_SSID_VEN1	0x0608
 #define BCM94313HMG_SSID_VEN1	0x0609
-
-
-#define BCM4335_D11AC_ID	0x43ae
-#define BCM4335_D11AC2G_ID	0x43af
-#define BCM4335_D11AC5G_ID	0x43b0
-#define BCM4352_D11AC_ID	0x43b1		
-#define BCM4352_D11AC2G_ID	0x43b2		
-#define BCM4352_D11AC5G_ID	0x43b3		
-
-#define	BCMGPRS_UART_ID		0x4333		
-#define	BCMGPRS2_UART_ID	0x4344		
-#define FPGA_JTAGM_ID		0x43f0		
-#define BCM_JTAGM_ID		0x43f1		
-#define SDIOH_FPGA_ID		0x43f2		
-#define BCM_SDIOH_ID		0x43f3		
-#define SDIOD_FPGA_ID		0x43f4		
-#define SPIH_FPGA_ID		0x43f5		
-#define BCM_SPIH_ID		0x43f6		
-#define MIMO_FPGA_ID		0x43f8		
-#define BCM_JTAGM2_ID		0x43f9		
-#define SDHCI_FPGA_ID		0x43fa		
-#define	BCM4402_ENET_ID		0x4402		
-#define	BCM4402_V90_ID		0x4403		
-#define	BCM4410_DEVICE_ID	0x4410		
-#define	BCM4412_DEVICE_ID	0x4412		
-#define	BCM4430_DEVICE_ID	0x4430		
-#define	BCM4432_DEVICE_ID	0x4432		
-#define	BCM4704_ENET_ID		0x4706		
-#define	BCM4710_DEVICE_ID	0x4710		
-#define	BCM47XX_AUDIO_ID	0x4711		
-#define	BCM47XX_V90_ID		0x4712		
-#define	BCM47XX_ENET_ID		0x4713		
-#define	BCM47XX_EXT_ID		0x4714		
-#define	BCM47XX_GMAC_ID		0x4715		
-#define	BCM47XX_USBH_ID		0x4716		
-#define	BCM47XX_USBD_ID		0x4717		
-#define	BCM47XX_IPSEC_ID	0x4718		
-#define	BCM47XX_ROBO_ID		0x4719		
-#define	BCM47XX_USB20H_ID	0x471a		
-#define	BCM47XX_USB20D_ID	0x471b		
-#define	BCM47XX_ATA100_ID	0x471d		
-#define	BCM47XX_SATAXOR_ID	0x471e		
-#define	BCM47XX_GIGETH_ID	0x471f		
-#define	BCM4712_MIPS_ID		0x4720		
-#define	BCM4716_DEVICE_ID	0x4722		
-#define BCM47XX_SMBUS_EMU_ID	0x47fe		
-#define	BCM47XX_XOR_EMU_ID	0x47ff		
-#define	EPI41210_DEVICE_ID	0xa0fa		
-#define	EPI41230_DEVICE_ID	0xa10e		
-#define JINVANI_SDIOH_ID	0x4743		
-#define BCM27XX_SDIOH_ID	0x2702		
-#define PCIXX21_FLASHMEDIA_ID	0x803b		
-#define PCIXX21_SDIOH_ID	0x803c		
-#define R5C822_SDIOH_ID		0x0822		
-#define JMICRON_SDIOH_ID	0x2381		
-
-
-#define	BCM4306_CHIP_ID		0x4306		
-#define	BCM4311_CHIP_ID		0x4311		
-#define	BCM43111_CHIP_ID	43111		
-#define	BCM43112_CHIP_ID	43112		
-#define	BCM4312_CHIP_ID		0x4312		
-#define BCM4313_CHIP_ID		0x4313		
-#define	BCM43131_CHIP_ID	43131		
-#define	BCM4315_CHIP_ID		0x4315		
-#define	BCM4318_CHIP_ID		0x4318		
-#define	BCM4319_CHIP_ID		0x4319		
-#define	BCM4320_CHIP_ID		0x4320		
-#define	BCM4321_CHIP_ID		0x4321		
-#define	BCM43217_CHIP_ID	43217		
-#define	BCM4322_CHIP_ID		0x4322		
-#define	BCM43221_CHIP_ID	43221		
-#define	BCM43222_CHIP_ID	43222		
-#define	BCM43224_CHIP_ID	43224		
-#define	BCM43225_CHIP_ID	43225		
-#define	BCM43227_CHIP_ID	43227		
-#define	BCM43228_CHIP_ID	43228		
-#define	BCM43226_CHIP_ID	43226		
-#define	BCM43231_CHIP_ID	43231		
-#define	BCM43234_CHIP_ID	43234		
-#define	BCM43235_CHIP_ID	43235		
-#define	BCM43236_CHIP_ID	43236		
-#define	BCM43237_CHIP_ID	43237		
-#define	BCM43238_CHIP_ID	43238		
-#define	BCM43239_CHIP_ID	43239		
-#define	BCM43420_CHIP_ID	43420		
-#define	BCM43421_CHIP_ID	43421		
-#define	BCM43428_CHIP_ID	43428		
-#define	BCM43431_CHIP_ID	43431		
-#define	BCM43460_CHIP_ID	43460		
-#define	BCM4325_CHIP_ID		0x4325		
-#define	BCM4328_CHIP_ID		0x4328		
-#define	BCM4329_CHIP_ID		0x4329		
-#define	BCM4331_CHIP_ID		0x4331		
-#define BCM4336_CHIP_ID		0x4336		
-#define BCM43362_CHIP_ID	43362		
-#define BCM4330_CHIP_ID		0x4330		
-#define BCM6362_CHIP_ID		0x6362		
-#define BCM4314_CHIP_ID		0x4314		
-#define BCM43142_CHIP_ID	43142		
-#define	BCM4324_CHIP_ID		0x4324		
-#define	BCM43242_CHIP_ID	43242		
-#define BCM4334_CHIP_ID		0x4334		
-#define BCM4360_CHIP_ID		0x4360          
-#define BCM4352_CHIP_ID		0x4352          
+#define BCM943142HM_SSID_VEN1	0x0611
+
+#define BCM43143_D11N2G_ID	0x4366		/* 43143 802.11n 2.4G device */
+
+#define BCM43242_D11N_ID	0x4367		/* 43242 802.11n dualband device */
+#define BCM43242_D11N2G_ID	0x4368		/* 43242 802.11n 2.4G device */
+#define BCM43242_D11N5G_ID	0x4369		/* 43242 802.11n 5G device */
+
+#define BCM4350_D11AC_ID	0x43a3
+#define BCM4350_D11AC2G_ID	0x43a4
+#define BCM4350_D11AC5G_ID	0x43a5
+
+
+#define	BCMGPRS_UART_ID		0x4333		/* Uart id used by 4306/gprs card */
+#define	BCMGPRS2_UART_ID	0x4344		/* Uart id used by 4306/gprs card */
+#define FPGA_JTAGM_ID		0x43f0		/* FPGA jtagm device id */
+#define BCM_JTAGM_ID		0x43f1		/* BCM jtagm device id */
+#define SDIOH_FPGA_ID		0x43f2		/* sdio host fpga */
+#define BCM_SDIOH_ID		0x43f3		/* BCM sdio host id */
+#define SDIOD_FPGA_ID		0x43f4		/* sdio device fpga */
+#define SPIH_FPGA_ID		0x43f5		/* PCI SPI Host Controller FPGA */
+#define BCM_SPIH_ID		0x43f6		/* Synopsis SPI Host Controller */
+#define MIMO_FPGA_ID		0x43f8		/* FPGA mimo minimacphy device id */
+#define BCM_JTAGM2_ID		0x43f9		/* BCM alternate jtagm device id */
+#define SDHCI_FPGA_ID		0x43fa		/* Standard SDIO Host Controller FPGA */
+#define	BCM4402_ENET_ID		0x4402		/* 4402 enet */
+#define	BCM4402_V90_ID		0x4403		/* 4402 v90 codec */
+#define	BCM4410_DEVICE_ID	0x4410		/* bcm44xx family pci iline */
+#define	BCM4412_DEVICE_ID	0x4412		/* bcm44xx family pci enet */
+#define	BCM4430_DEVICE_ID	0x4430		/* bcm44xx family cardbus iline */
+#define	BCM4432_DEVICE_ID	0x4432		/* bcm44xx family cardbus enet */
+#define	BCM4704_ENET_ID		0x4706		/* 4704 enet (Use 47XX_ENET_ID instead!) */
+#define	BCM4710_DEVICE_ID	0x4710		/* 4710 primary function 0 */
+#define	BCM47XX_AUDIO_ID	0x4711		/* 47xx audio codec */
+#define	BCM47XX_V90_ID		0x4712		/* 47xx v90 codec */
+#define	BCM47XX_ENET_ID		0x4713		/* 47xx enet */
+#define	BCM47XX_EXT_ID		0x4714		/* 47xx external i/f */
+#define	BCM47XX_GMAC_ID		0x4715		/* 47xx Unimac based GbE */
+#define	BCM47XX_USBH_ID		0x4716		/* 47xx usb host */
+#define	BCM47XX_USBD_ID		0x4717		/* 47xx usb device */
+#define	BCM47XX_IPSEC_ID	0x4718		/* 47xx ipsec */
+#define	BCM47XX_ROBO_ID		0x4719		/* 47xx/53xx roboswitch core */
+#define	BCM47XX_USB20H_ID	0x471a		/* 47xx usb 2.0 host */
+#define	BCM47XX_USB20D_ID	0x471b		/* 47xx usb 2.0 device */
+#define	BCM47XX_ATA100_ID	0x471d		/* 47xx parallel ATA */
+#define	BCM47XX_SATAXOR_ID	0x471e		/* 47xx serial ATA & XOR DMA */
+#define	BCM47XX_GIGETH_ID	0x471f		/* 47xx GbE (5700) */
+#define	BCM4712_MIPS_ID		0x4720		/* 4712 base devid */
+#define	BCM4716_DEVICE_ID	0x4722		/* 4716 base devid */
+#define	BCM47XX_USB30H_ID	0x472a		/* 47xx usb 3.0 host */
+#define	BCM47XX_USB30D_ID	0x472b		/* 47xx usb 3.0 device */
+#define BCM47XX_SMBUS_EMU_ID	0x47fe		/* 47xx emulated SMBus device */
+#define	BCM47XX_XOR_EMU_ID	0x47ff		/* 47xx emulated XOR engine */
+#define	EPI41210_DEVICE_ID	0xa0fa		/* bcm4210 */
+#define	EPI41230_DEVICE_ID	0xa10e		/* bcm4230 */
+#define JINVANI_SDIOH_ID	0x4743		/* Jinvani SDIO Gold Host */
+#define BCM27XX_SDIOH_ID	0x2702		/* BCM27xx Standard SDIO Host */
+#define PCIXX21_FLASHMEDIA_ID	0x803b		/* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH_ID	0x803c		/* TI PCI xx21 Standard Host Controller */
+#define R5C822_SDIOH_ID		0x0822		/* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host */
+#define JMICRON_SDIOH_ID	0x2381		/* JMicron Standard SDIO Host Controller */
+
+/* Chip IDs */
+#define	BCM4306_CHIP_ID		0x4306		/* 4306 chipcommon chipid */
+#define	BCM4311_CHIP_ID		0x4311		/* 4311 PCIe 802.11a/b/g */
+#define	BCM43111_CHIP_ID	43111		/* 43111 chipcommon chipid (OTP chipid) */
+#define	BCM43112_CHIP_ID	43112		/* 43112 chipcommon chipid (OTP chipid) */
+#define	BCM4312_CHIP_ID		0x4312		/* 4312 chipcommon chipid */
+#define BCM4313_CHIP_ID		0x4313		/* 4313 chip id */
+#define	BCM43131_CHIP_ID	43131		/* 43131 chip id (OTP chipid) */
+#define	BCM4315_CHIP_ID		0x4315		/* 4315 chip id */
+#define	BCM4318_CHIP_ID		0x4318		/* 4318 chipcommon chipid */
+#define	BCM4319_CHIP_ID		0x4319		/* 4319 chip id */
+#define	BCM4320_CHIP_ID		0x4320		/* 4320 chipcommon chipid */
+#define	BCM4321_CHIP_ID		0x4321		/* 4321 chipcommon chipid */
+#define	BCM43217_CHIP_ID	43217		/* 43217 chip id (OTP chipid) */
+#define	BCM4322_CHIP_ID		0x4322		/* 4322 chipcommon chipid */
+#define	BCM43221_CHIP_ID	43221		/* 43221 chipcommon chipid (OTP chipid) */
+#define	BCM43222_CHIP_ID	43222		/* 43222 chipcommon chipid */
+#define	BCM43224_CHIP_ID	43224		/* 43224 chipcommon chipid */
+#define	BCM43225_CHIP_ID	43225		/* 43225 chipcommon chipid */
+#define	BCM43227_CHIP_ID	43227		/* 43227 chipcommon chipid */
+#define	BCM43228_CHIP_ID	43228		/* 43228 chipcommon chipid */
+#define	BCM43226_CHIP_ID	43226		/* 43226 chipcommon chipid */
+#define	BCM43231_CHIP_ID	43231		/* 43231 chipcommon chipid (OTP chipid) */
+#define	BCM43234_CHIP_ID	43234		/* 43234 chipcommon chipid */
+#define	BCM43235_CHIP_ID	43235		/* 43235 chipcommon chipid */
+#define	BCM43236_CHIP_ID	43236		/* 43236 chipcommon chipid */
+#define	BCM43237_CHIP_ID	43237		/* 43237 chipcommon chipid */
+#define	BCM43238_CHIP_ID	43238		/* 43238 chipcommon chipid */
+#define	BCM43239_CHIP_ID	43239		/* 43239 chipcommon chipid */
+#define	BCM43420_CHIP_ID	43420		/* 43222 chipcommon chipid (OTP, RBBU) */
+#define	BCM43421_CHIP_ID	43421		/* 43224 chipcommon chipid (OTP, RBBU) */
+#define	BCM43428_CHIP_ID	43428		/* 43228 chipcommon chipid (OTP, RBBU) */
+#define	BCM43431_CHIP_ID	43431		/* 4331  chipcommon chipid (OTP, RBBU) */
+#define	BCM43460_CHIP_ID	43460		/* 4360  chipcommon chipid (OTP, RBBU) */
+#define	BCM4325_CHIP_ID		0x4325		/* 4325 chip id */
+#define	BCM4328_CHIP_ID		0x4328		/* 4328 chip id */
+#define	BCM4329_CHIP_ID		0x4329		/* 4329 chipcommon chipid */
+#define	BCM4331_CHIP_ID		0x4331		/* 4331 chipcommon chipid */
+#define BCM4336_CHIP_ID		0x4336		/* 4336 chipcommon chipid */
+#define BCM43362_CHIP_ID	43362		/* 43362 chipcommon chipid */
+#define BCM4330_CHIP_ID		0x4330		/* 4330 chipcommon chipid */
+#define BCM6362_CHIP_ID		0x6362		/* 6362 chipcommon chipid */
+#define BCM4314_CHIP_ID		0x4314		/* 4314 chipcommon chipid */
+#define BCM43142_CHIP_ID	43142		/* 43142 chipcommon chipid */
+#define BCM43143_CHIP_ID	43143		/* 43143 chipcommon chipid */
+#define	BCM4324_CHIP_ID		0x4324		/* 4324 chipcommon chipid */
+#define	BCM43242_CHIP_ID	43242		/* 43242 chipcommon chipid */
+#define	BCM43243_CHIP_ID	43243		/* 43243 chipcommon chipid */
+#define BCM4334_CHIP_ID		0x4334		/* 4334 chipcommon chipid */
+#define BCM4335_CHIP_ID		0x4335		/* 4335 chipcommon chipid */
+#define BCM4360_CHIP_ID		0x4360          /* 4360 chipcommon chipid */
+#define BCM4352_CHIP_ID		0x4352          /* 4352 chipcommon chipid */
 #define BCM43526_CHIP_ID	0xAA06
-#define BCM43341_CHIP_ID	43341		
-#define BCM43342_CHIP_ID	43342		
-
+#define BCM43341_CHIP_ID	43341		/* 43341 chipcommon chipid */
+#define BCM43342_CHIP_ID	43342		/* 43342 chipcommon chipid */
 #define BCM4335_CHIP_ID         0x4335
-
-#define	BCM4342_CHIP_ID		4342		
-#define	BCM4402_CHIP_ID		0x4402		
-#define	BCM4704_CHIP_ID		0x4704		
-#define	BCM4706_CHIP_ID		0x5300		
-#define	BCM4710_CHIP_ID		0x4710		
-#define	BCM4712_CHIP_ID		0x4712		
-#define	BCM4716_CHIP_ID		0x4716		
-#define	BCM47162_CHIP_ID	47162		
-#define	BCM4748_CHIP_ID		0x4748		
-#define	BCM4749_CHIP_ID		0x4749		
-#define BCM4785_CHIP_ID		0x4785		
-#define	BCM5350_CHIP_ID		0x5350		
-#define	BCM5352_CHIP_ID		0x5352		
-#define	BCM5354_CHIP_ID		0x5354		
-#define BCM5365_CHIP_ID		0x5365		
-#define	BCM5356_CHIP_ID		0x5356		
-#define	BCM5357_CHIP_ID		0x5357		
-#define	BCM53572_CHIP_ID	53572		
-
-
-#define	BCM4303_PKG_ID		2		
-#define	BCM4309_PKG_ID		1		
-#define	BCM4712LARGE_PKG_ID	0		
-#define	BCM4712SMALL_PKG_ID	1		
-#define	BCM4712MID_PKG_ID	2		
-#define BCM4328USBD11G_PKG_ID	2		
-#define BCM4328USBDUAL_PKG_ID	3		
-#define BCM4328SDIOD11G_PKG_ID	4		
-#define BCM4328SDIODUAL_PKG_ID	5		
-#define BCM4329_289PIN_PKG_ID	0		
-#define BCM4329_182PIN_PKG_ID	1		
-#define BCM5354E_PKG_ID		1		
-#define	BCM4716_PKG_ID		8		
-#define	BCM4717_PKG_ID		9		
-#define	BCM4718_PKG_ID		10		
-#define BCM5356_PKG_NONMODE	1		
-#define BCM5358U_PKG_ID		8		
-#define BCM5358_PKG_ID		9		
-#define BCM47186_PKG_ID		10		
-#define BCM5357_PKG_ID		11		
-#define BCM5356U_PKG_ID		12		
-#define BCM53572_PKG_ID		8		
-#define BCM5357C0_PKG_ID	8		
-#define BCM47188_PKG_ID		9		
-#define BCM5358C0_PKG_ID	0xa		
-#define BCM5356C0_PKG_ID	0xb		
-#define BCM4331TT_PKG_ID        8		
-#define BCM4331TN_PKG_ID        9		
-#define BCM4331TNA0_PKG_ID     0xb		
-#define	BCM4706L_PKG_ID		1		
-
-#define HDLSIM5350_PKG_ID	1		
-#define HDLSIM_PKG_ID		14		
-#define HWSIM_PKG_ID		15		
-#define BCM43224_FAB_CSM	0x8		
-#define BCM43224_FAB_SMIC	0xa		
+#define BCM4350_CHIP_ID		0x4350          /* 4350 chipcommon chipid */
+
+#define	BCM4342_CHIP_ID		4342		/* 4342 chipcommon chipid (OTP, RBBU) */
+#define	BCM4402_CHIP_ID		0x4402		/* 4402 chipid */
+#define	BCM4704_CHIP_ID		0x4704		/* 4704 chipcommon chipid */
+#define	BCM4706_CHIP_ID		0x5300		/* 4706 chipcommon chipid */
+#define BCM4707_CHIP_ID		53010		/* 4707 chipcommon chipid */
+#define BCM53018_CHIP_ID	53018		/* 53018 chipcommon chipid */
+#define BCM4707_CHIP(chipid)	(((chipid) == BCM4707_CHIP_ID) || ((chipid) == BCM53018_CHIP_ID))
+#define	BCM4710_CHIP_ID		0x4710		/* 4710 chipid */
+#define	BCM4712_CHIP_ID		0x4712		/* 4712 chipcommon chipid */
+#define	BCM4716_CHIP_ID		0x4716		/* 4716 chipcommon chipid */
+#define	BCM47162_CHIP_ID	47162		/* 47162 chipcommon chipid */
+#define	BCM4748_CHIP_ID		0x4748		/* 4716 chipcommon chipid (OTP, RBBU) */
+#define	BCM4749_CHIP_ID		0x4749		/* 5357 chipcommon chipid (OTP, RBBU) */
+#define BCM4785_CHIP_ID		0x4785		/* 4785 chipcommon chipid */
+#define	BCM5350_CHIP_ID		0x5350		/* 5350 chipcommon chipid */
+#define	BCM5352_CHIP_ID		0x5352		/* 5352 chipcommon chipid */
+#define	BCM5354_CHIP_ID		0x5354		/* 5354 chipcommon chipid */
+#define BCM5365_CHIP_ID		0x5365		/* 5365 chipcommon chipid */
+#define	BCM5356_CHIP_ID		0x5356		/* 5356 chipcommon chipid */
+#define	BCM5357_CHIP_ID		0x5357		/* 5357 chipcommon chipid */
+#define	BCM53572_CHIP_ID	53572		/* 53572 chipcommon chipid */
+
+/* Package IDs */
+#define	BCM4303_PKG_ID		2		/* 4303 package id */
+#define	BCM4309_PKG_ID		1		/* 4309 package id */
+#define	BCM4712LARGE_PKG_ID	0		/* 340pin 4712 package id */
+#define	BCM4712SMALL_PKG_ID	1		/* 200pin 4712 package id */
+#define	BCM4712MID_PKG_ID	2		/* 225pin 4712 package id */
+#define BCM4328USBD11G_PKG_ID	2		/* 4328 802.11g USB package id */
+#define BCM4328USBDUAL_PKG_ID	3		/* 4328 802.11a/g USB package id */
+#define BCM4328SDIOD11G_PKG_ID	4		/* 4328 802.11g SDIO package id */
+#define BCM4328SDIODUAL_PKG_ID	5		/* 4328 802.11a/g SDIO package id */
+#define BCM4329_289PIN_PKG_ID	0		/* 4329 289-pin package id */
+#define BCM4329_182PIN_PKG_ID	1		/* 4329N 182-pin package id */
+#define BCM5354E_PKG_ID		1		/* 5354E package id */
+#define	BCM4716_PKG_ID		8		/* 4716 package id */
+#define	BCM4717_PKG_ID		9		/* 4717 package id */
+#define	BCM4718_PKG_ID		10		/* 4718 package id */
+#define BCM5356_PKG_NONMODE	1		/* 5356 package without nmode suppport */
+#define BCM5358U_PKG_ID		8		/* 5358U package id */
+#define BCM5358_PKG_ID		9		/* 5358 package id */
+#define BCM47186_PKG_ID		10		/* 47186 package id */
+#define BCM5357_PKG_ID		11		/* 5357 package id */
+#define BCM5356U_PKG_ID		12		/* 5356U package id */
+#define BCM53572_PKG_ID		8		/* 53572 package id */
+#define BCM5357C0_PKG_ID	8		/* 5357c0 package id (the same as 53572) */
+#define BCM47188_PKG_ID		9		/* 47188 package id */
+#define BCM5358C0_PKG_ID	0xa		/* 5358c0 package id */
+#define BCM5356C0_PKG_ID	0xb		/* 5356c0 package id */
+#define BCM4331TT_PKG_ID        8		/* 4331 12x12 package id */
+#define BCM4331TN_PKG_ID        9		/* 4331 12x9 package id */
+#define BCM4331TNA0_PKG_ID     0xb		/* 4331 12x9 package id */
+#define	BCM4706L_PKG_ID		1		/* 4706L package id */
+
+#define HDLSIM5350_PKG_ID	1		/* HDL simulator package id for a 5350 */
+#define HDLSIM_PKG_ID		14		/* HDL simulator package id */
+#define HWSIM_PKG_ID		15		/* Hardware simulator package id */
+#define BCM43224_FAB_CSM	0x8		/* the chip is manufactured by CSM */
+#define BCM43224_FAB_SMIC	0xa		/* the chip is manufactured by SMIC */
 #define BCM4336_WLBGA_PKG_ID	0x8
 #define BCM4330_WLBGA_PKG_ID	0x0
-#define BCM4314PCIE_ARM_PKG_ID		(8 | 0)	
-#define BCM4314SDIO_PKG_ID		(8 | 1)	
-#define BCM4314PCIE_PKG_ID		(8 | 2)	
-#define BCM4314SDIO_ARM_PKG_ID		(8 | 3)	
-#define BCM4314SDIO_FPBGA_PKG_ID	(8 | 4)	
-#define BCM4314DEV_PKG_ID		(8 | 6)	
-
-#define PCIXX21_FLASHMEDIA0_ID	0x8033		
-#define PCIXX21_SDIOH0_ID	0x8034		
-
-
-#define	BFL_BTC2WIRE		0x00000001  
-#define BFL_BTCOEX      0x00000001      
-#define	BFL_PACTRL		0x00000002  
-#define BFL_AIRLINEMODE	0x00000004  
-#define	BFL_ADCDIV		0x00000008  
-#define	BFL_RFPLL	        0x00000008  
-#define	BFL_ENETROBO		0x00000010  
-#define	BFL_NOPLLDOWN		0x00000020  
-#define	BFL_CCKHIPWR		0x00000040  
-#define	BFL_ENETADM		0x00000080  
-#define	BFL_ENETVLAN		0x00000100  
-#define	BFL_UNUSED		0x00000200
-#define BFL_NOPCI		0x00000400  
-#define BFL_FEM			0x00000800  
-#define BFL_EXTLNA		0x00001000  
-#define BFL_HGPA		0x00002000  
-#define	BFL_BTC2WIRE_ALTGPIO	0x00004000  
-#define	BFL_ALTIQ		0x00008000  
-#define BFL_NOPA		0x00010000  
-#define BFL_RSSIINV		0x00020000  
-#define BFL_PAREF		0x00040000  
-#define BFL_3TSWITCH		0x00080000  
-#define BFL_PHASESHIFT		0x00100000  
-#define BFL_BUCKBOOST		0x00200000  
-#define BFL_FEM_BT		0x00400000  
-#define BFL_NOCBUCK		0x00800000  
-#define BFL_CCKFAVOREVM		0x01000000  
-#define BFL_PALDO		0x02000000  
-#define BFL_LNLDO2_2P5		0x04000000  
+#define BCM4314PCIE_ARM_PKG_ID		(8 | 0)	/* 4314 QFN PCI package id, bit 3 tie high */
+#define BCM4314SDIO_PKG_ID		(8 | 1)	/* 4314 QFN SDIO package id */
+#define BCM4314PCIE_PKG_ID		(8 | 2)	/* 4314 QFN PCI (ARM-less) package id */
+#define BCM4314SDIO_ARM_PKG_ID		(8 | 3)	/* 4314 QFN SDIO (ARM-less) package id */
+#define BCM4314SDIO_FPBGA_PKG_ID	(8 | 4)	/* 4314 FpBGA SDIO package id */
+#define BCM4314DEV_PKG_ID		(8 | 6)	/* 4314 Developement package id */
+
+#define BCM4707_PKG_ID		1		/* 4707 package id */
+#define BCM4708_PKG_ID		2		/* 4708 package id */
+#define BCM4709_PKG_ID		0		/* 4709 package id */
+
+#define PCIXX21_FLASHMEDIA0_ID	0x8033		/* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH0_ID	0x8034		/* TI PCI xx21 Standard Host Controller */
+
+#define BCM4335_WLCSP_PKG_ID	(0x0)	/* WLCSP Module/Mobile SDIO/HSIC. */
+#define BCM4335_FCBGA_PKG_ID	(0x1)	/* FCBGA PC/Embeded/Media PCIE/SDIO */
+#define BCM4335_WLBGA_PKG_ID	(0x2)	/* WLBGA COB/Mobile SDIO/HSIC. */
+#define BCM4335_FCBGAD_PKG_ID	(0x3)	/* FCBGA Debug Debug/Dev All if's. */
+#define BCM4335_PKG_MASK	(0x3)
+
+/* boardflags */
+#define	BFL_BTC2WIRE		0x00000001  /* old 2wire Bluetooth coexistence, OBSOLETE */
+#define BFL_BTCOEX      0x00000001      /* Board supports BTCOEX */
+#define	BFL_PACTRL		0x00000002  /* Board has gpio 9 controlling the PA */
+#define BFL_AIRLINEMODE	0x00000004  /* Board implements gpio 13 radio disable indication, UNUSED */
+#define	BFL_ADCDIV		0x00000008  /* Board has the rssi ADC divider */
+#define BFL_DIS_256QAM		0x00000008
+#define	BFL_ENETROBO		0x00000010  /* Board has robo switch or core */
+#define	BFL_NOPLLDOWN		0x00000020  /* Not ok to power down the chip pll and oscillator */
+#define	BFL_CCKHIPWR		0x00000040  /* Can do high-power CCK transmission */
+#define	BFL_ENETADM		0x00000080  /* Board has ADMtek switch */
+#define	BFL_ENETVLAN		0x00000100  /* Board has VLAN capability */
+#define	BFL_LTECOEX		0x00000200  /* Board has LTE coex capability */
+#define BFL_NOPCI		0x00000400  /* Board leaves PCI floating */
+#define BFL_FEM			0x00000800  /* Board supports the Front End Module */
+#define BFL_EXTLNA		0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_HGPA		0x00002000  /* Board has a high gain PA */
+#define	BFL_BTC2WIRE_ALTGPIO	0x00004000
+/* Board's BTC 2wire is in the alternate gpios OBSLETE */
+#define	BFL_ALTIQ		0x00008000  /* Alternate I/Q settings */
+#define BFL_NOPA		0x00010000  /* Board has no PA */
+#define BFL_RSSIINV		0x00020000  /* Board's RSSI uses positive slope(not TSSI) */
+#define BFL_PAREF		0x00040000  /* Board uses the PARef LDO */
+#define BFL_3TSWITCH		0x00080000  /* Board uses a triple throw switch shared with BT */
+#define BFL_PHASESHIFT		0x00100000  /* Board can support phase shifter */
+#define BFL_BUCKBOOST		0x00200000  /* Power topology uses BUCKBOOST */
+#define BFL_FEM_BT		0x00400000  /* Board has FEM and switch to share antenna w/ BT */
+#define BFL_RXCHAIN_OFF_BT 0x00400000 /* one rxchain is to be shut off when BT is active */
+#define BFL_NOCBUCK		0x00800000  /* Power topology doesn't use CBUCK */
+#define BFL_CCKFAVOREVM		0x01000000  /* Favor CCK EVM over spectral mask */
+#define BFL_PALDO		0x02000000  /* Power topology uses PALDO */
+#define BFL_LNLDO2_2P5		0x04000000  /* Select 2.5V as LNLDO2 output voltage */
 #define BFL_FASTPWR		0x08000000
-#define BFL_UCPWRCTL_MININDX	0x08000000  
-#define BFL_EXTLNA_5GHz		0x10000000  
-#define BFL_TRSW_1by2		0x20000000  
-#define BFL_LO_TRSW_R_5GHz	0x40000000  
-#define BFL_ELNA_GAINDEF	0x80000000  
-#define BFL_EXTLNA_TX	0x20000000	
-
-
-#define BFL2_RXBB_INT_REG_DIS	0x00000001  
-#define BFL2_APLL_WAR		0x00000002  
-#define BFL2_TXPWRCTRL_EN	0x00000004  
-#define BFL2_2X4_DIV		0x00000008  
-#define BFL2_5G_PWRGAIN		0x00000010  
-#define BFL2_PCIEWAR_OVR	0x00000020  
-#define BFL2_CAESERS_BRD	0x00000040  
-#define BFL2_BTC3WIRE		0x00000080  
-#define BFL2_BTCLEGACY          0x00000080  
-#define BFL2_SKWRKFEM_BRD	0x00000100  
-#define BFL2_SPUR_WAR		0x00000200  
-#define BFL2_GPLL_WAR		0x00000400  
-#define BFL2_TRISTATE_LED	0x00000800  
-#define BFL2_SINGLEANT_CCK	0x00001000  
-#define BFL2_2G_SPUR_WAR	0x00002000  
-#define BFL2_BPHY_ALL_TXCORES	0x00004000  
-#define BFL2_FCC_BANDEDGE_WAR	0x00008000  
-#define BFL2_GPLL_WAR2	        0x00010000  
+#define BFL_UCPWRCTL_MININDX	0x08000000  /* Enforce min power index to avoid FEM damage */
+#define BFL_EXTLNA_5GHz		0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_TRSW_1by2		0x20000000  /* Board has 2 TRSW's in 1by2 designs */
+#define BFL_GAINBOOSTA01        0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL_LO_TRSW_R_5GHz	0x40000000  /* In 5G do not throw TRSW to T for clipLO gain */
+#define BFL_ELNA_GAINDEF	0x80000000  /* Backoff InitGain based on elna_2g/5g field
+					     * when this flag is set
+					     */
+#define BFL_EXTLNA_TX	0x20000000	/* Temp boardflag to indicate to */
+
+/* boardflags2 */
+#define BFL2_RXBB_INT_REG_DIS	0x00000001  /* Board has an external rxbb regulator */
+#define BFL2_APLL_WAR		0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_TXPWRCTRL_EN	0x00000004  /* Board permits enabling TX Power Control */
+#define BFL2_2X4_DIV		0x00000008  /* Board supports the 2X4 diversity switch */
+#define BFL2_5G_PWRGAIN		0x00000010  /* Board supports 5G band power gain */
+#define BFL2_PCIEWAR_OVR	0x00000020  /* Board overrides ASPM and Clkreq settings */
+#define BFL2_CAESERS_BRD	0x00000040  /* Board is Caesers brd (unused by sw) */
+#define BFL2_BTC3WIRE		0x00000080  /* Board support legacy 3 wire or 4 wire */
+#define BFL2_BTCLEGACY          0x00000080  /* Board support legacy 3/4 wire, to replace
+					     * BFL2_BTC3WIRE
+					     */
+#define BFL2_SKWRKFEM_BRD	0x00000100  /* 4321mcm93 board uses Skyworks FEM */
+#define BFL2_SPUR_WAR		0x00000200  /* Board has a WAR for clock-harmonic spurs */
+#define BFL2_GPLL_WAR		0x00000400  /* Flag to narrow G-band PLL loop b/w */
+#define BFL2_TRISTATE_LED	0x00000800  /* Tri-state the LED */
+#define BFL2_SINGLEANT_CCK	0x00001000  /* Tx CCK pkts on Ant 0 only */
+#define BFL2_2G_SPUR_WAR	0x00002000  /* WAR to reduce and avoid clock-harmonic spurs in 2G */
+#define BFL2_BPHY_ALL_TXCORES	0x00004000  /* Transmit bphy frames using all tx cores */
+#define BFL2_FCC_BANDEDGE_WAR	0x00008000  /* Activates WAR to improve FCC bandedge performance */
+#define BFL2_GPLL_WAR2	        0x00010000  /* Flag to widen G-band PLL loop b/w */
 #define BFL2_IPALVLSHIFT_3P3    0x00020000
-#define BFL2_INTERNDET_TXIQCAL  0x00040000  
-#define BFL2_XTALBUFOUTEN       0x00080000  
-				
-				
-
-#define BFL2_ANAPACTRL_2G	0x00100000  
-#define BFL2_ANAPACTRL_5G	0x00200000  
-#define BFL2_ELNACTRL_TRSW_2G	0x00400000  
-#define BFL2_BT_SHARE_ANT0	0x00800000  
-#define BFL2_TEMPSENSE_HIGHER	0x01000000  
-#define BFL2_BTC3WIREONLY       0x02000000  
-#define BFL2_PWR_NOMINAL	0x04000000  
-#define BFL2_EXTLNA_PWRSAVE	0x08000000  
-						
+#define BFL2_INTERNDET_TXIQCAL  0x00040000  /* Use internal envelope detector for TX IQCAL */
+#define BFL2_XTALBUFOUTEN       0x00080000  /* Keep the buffered Xtal output from radio on */
+				/* Most drivers will turn it off without this flag */
+				/* to save power. */
+
+#define BFL2_ANAPACTRL_2G	0x00100000  /* 2G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ANAPACTRL_5G	0x00200000  /* 5G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ELNACTRL_TRSW_2G	0x00400000  /* AZW4329: 2G gmode_elna_gain controls TR Switch */
+#define BFL2_BT_SHARE_ANT0	0x00800000 /* WLAN/BT share antenna 0 */
+#define BFL2_BT_SHARE_BM_BIT0	0x00800000  /* bit 0 of WLAN/BT shared core bitmap */
+#define BFL2_TEMPSENSE_HIGHER	0x01000000  /* The tempsense threshold can sustain higher value
+					     * than programmed. The exact delta is decided by
+					     * driver per chip/boardtype. This can be used
+					     * when tempsense qualification happens after shipment
+					     */
+#define BFL2_BTC3WIREONLY       0x02000000  /* standard 3 wire btc only.  4 wire not supported */
+#define BFL2_PWR_NOMINAL	0x04000000  /* 0: power reduction on, 1: no power reduction */
+#define BFL2_EXTLNA_PWRSAVE	0x08000000  /* boardflag to enable ucode to apply power save */
+						/* ucode control of eLNA during Tx */
 #define BFL2_4313_RADIOREG	0x10000000
-									   
-#define BFL2_SDR_EN		0x20000000	
-
-
-#define	BOARD_GPIO_BTC3W_IN	0x850	
-#define	BOARD_GPIO_BTC3W_OUT	0x020	
-#define	BOARD_GPIO_BTCMOD_IN	0x010	
-#define	BOARD_GPIO_BTCMOD_OUT	0x020	
-#define	BOARD_GPIO_BTC_IN	0x080	
-#define	BOARD_GPIO_BTC_OUT	0x100	
-#define	BOARD_GPIO_PACTRL	0x200	
-#define BOARD_GPIO_12		0x1000	
-#define BOARD_GPIO_13		0x2000	
-#define BOARD_GPIO_BTC4_IN	0x0800	
-#define BOARD_GPIO_BTC4_BT	0x2000	
-#define BOARD_GPIO_BTC4_STAT	0x4000	
-#define BOARD_GPIO_BTC4_WLAN	0x8000	
-#define	BOARD_GPIO_1_WLAN_PWR	0x02	
-#define	BOARD_GPIO_3_WLAN_PWR	0x08	
-#define	BOARD_GPIO_4_WLAN_PWR	0x10	
-
-#define GPIO_BTC4W_OUT_4312  0x010  
-#define GPIO_BTC4W_OUT_43224  0x020  
-#define GPIO_BTC4W_OUT_43224_SHARED  0x0e0  
-#define GPIO_BTC4W_OUT_43225  0x0e0  
-#define GPIO_BTC4W_OUT_43421  0x020  
-#define GPIO_BTC4W_OUT_4313  0x060  
-#define GPIO_BTC4W_OUT_4331_SHARED  0x010  
-
-#define	PCI_CFG_GPIO_SCS	0x10	
-#define PCI_CFG_GPIO_HWRAD	0x20	
-#define PCI_CFG_GPIO_XTAL	0x40	
-#define PCI_CFG_GPIO_PLL	0x80	
-
-
-#define PLL_DELAY		150		
-#define FREF_DELAY		200		
-#define MIN_SLOW_CLK		32		
-#define	XTAL_ON_DELAY		1000		
-
-
-
+									   /*  board rework */
+#define BFL2_DYNAMIC_VMID	0x10000000  /* boardflag to enable dynamic Vmid idle TSSI CAL */
+#define BFL2_SDR_EN		0x20000000  /* SDR enabled or disabled */
+#define BFL2_LNA1BYPFORTR2G  	0x40000000  /* acphy, enable lna1 bypass for clip gain, 2g */
+#define BFL2_LNA1BYPFORTR5G  	0x80000000  /* acphy, enable lna1 bypass for clip gain, 5g */
+
+/* SROM 11 - 11ac boardflag definitions */
+#define BFL_SROM11_BTCOEX  0x00000001  /* Board supports BTCOEX */
+#define BFL_SROM11_WLAN_BT_SH_XTL  0x00000002  /* bluetooth and wlan share same crystal */
+#define BFL_SROM11_EXTLNA	0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_SROM11_EXTLNA_5GHz	0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_SROM11_GAINBOOSTA01	0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL2_SROM11_APLL_WAR	0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_SROM11_ANAPACTRL_2G  0x00100000  /* 2G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_ANAPACTRL_5G  0x00200000  /* 5G ext PAs are ctrl-ed by analog PA ctrl lines */
+
+/* boardflags3 */
+#define BFL3_FEMCTRL_SUB	0x00000007  /* acphy, subrevs of femctrl on top of srom_femctrl */
+#define BFL3_RCAL_WAR		0x00000008  /* acphy, rcal war active on this board (4335a0) */
+#define BFL3_TXGAINTBLID	0x00000070  /* acphy, txgain table id */
+#define BFL3_TXGAINTBLID_SHIFT	0x4         /* acphy, txgain table id shift bit */
+#define BFL3_TSSI_DIV_WAR	0x00000080  /* acphy, Seperate paparam for 20/40/80 */
+#define BFL3_TSSI_DIV_WAR_SHIFT	0x7         /* acphy, Seperate paparam for 20/40/80 shift bit */
+#define BFL3_FEMTBL_FROM_NVRAM  0x00000100  /* acphy, femctrl table is read from nvram */
+#define BFL3_FEMTBL_FROM_NVRAM_SHIFT  0x8         /* acphy, femctrl table is read from nvram */
+#define BFL3_AGC_CFG_2G         0x00000200  /* acphy, gain control configuration for 2G */
+#define BFL3_AGC_CFG_5G         0x00000400  /* acphy, gain control configuration for 5G */
+#define BFL3_PPR_BIT_EXT        0x00000800  /* acphy, bit position for 1bit extension for ppr */
+#define BFL3_PPR_BIT_EXT_SHIFT  11          /* acphy, bit shift for 1bit extension for ppr */
+#define BFL3_BBPLL_SPR_MODE_DIS 0x00001000  /* acphy, disables bbpll spur modes */
+#define BFL3_RCAL_OTP_VAL_EN    0x00002000  /* acphy, to read rcal_trim value from otp */
+#define BFL3_2GTXGAINTBL_BLANK  0x00004000  /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_2GTXGAINTBL_BLANK_SHIFT 14     /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK  0x00008000  /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK_SHIFT 15     /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_BT_SHARE_BM_BIT1   0x40000000  /* bit 1 of WLAN/BT shared core bitmap */
+#define BFL3_PHASETRACK_MAX_ALPHABETA	  0x00010000  /* acphy, to max out alpha,beta to 511 */
+#define BFL3_PHASETRACK_MAX_ALPHABETA_SHIFT 16       /* acphy, to max out alpha,beta to 511 */
+#define BFL3_BT_SHARE_BM_BIT1 0x40000000 /* bit 1 of WLAN/BT shared core bitmap */
+#define BFL3_EN_NONBRCM_TXBF      0x10000000  /* acphy, enable non-brcm TXBF */
+#define BFL3_EN_P2PLINK_TXBF      0x20000000  /* acphy, enable TXBF in p2p links */
+
+/* board specific GPIO assignment, gpio 0-3 are also customer-configurable led */
+#define	BOARD_GPIO_BTC3W_IN	0x850	/* bit 4 is RF_ACTIVE, bit 6 is STATUS, bit 11 is PRI */
+#define	BOARD_GPIO_BTC3W_OUT	0x020	/* bit 5 is TX_CONF */
+#define	BOARD_GPIO_BTCMOD_IN	0x010	/* bit 4 is the alternate BT Coexistence Input */
+#define	BOARD_GPIO_BTCMOD_OUT	0x020	/* bit 5 is the alternate BT Coexistence Out */
+#define	BOARD_GPIO_BTC_IN	0x080	/* bit 7 is BT Coexistence Input */
+#define	BOARD_GPIO_BTC_OUT	0x100	/* bit 8 is BT Coexistence Out */
+#define	BOARD_GPIO_PACTRL	0x200	/* bit 9 controls the PA on new 4306 boards */
+#define BOARD_GPIO_12		0x1000	/* gpio 12 */
+#define BOARD_GPIO_13		0x2000	/* gpio 13 */
+#define BOARD_GPIO_BTC4_IN	0x0800	/* gpio 11, coex4, in */
+#define BOARD_GPIO_BTC4_BT	0x2000	/* gpio 12, coex4, bt active */
+#define BOARD_GPIO_BTC4_STAT	0x4000	/* gpio 14, coex4, status */
+#define BOARD_GPIO_BTC4_WLAN	0x8000	/* gpio 15, coex4, wlan active */
+#define	BOARD_GPIO_1_WLAN_PWR	0x02	/* throttle WLAN power on X21 board */
+#define	BOARD_GPIO_3_WLAN_PWR	0x08	/* throttle WLAN power on X28 board */
+#define	BOARD_GPIO_4_WLAN_PWR	0x10	/* throttle WLAN power on X19 board */
+
+#define GPIO_BTC4W_OUT_4312  0x010  /* bit 4 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43224  0x020  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43224_SHARED  0x0e0  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43225  0x0e0  /* bit 5 BT_IODISABLE, bit 6 SW_BT, bit 7 SW_WL */
+#define GPIO_BTC4W_OUT_43421  0x020  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_4313  0x060  /* bit 5 SW_BT, bit 6 SW_WL */
+#define GPIO_BTC4W_OUT_4331_SHARED  0x010  /* GPIO 4  */
+
+#define	PCI_CFG_GPIO_SCS	0x10	/* PCI config space bit 4 for 4306c0 slow clock source */
+#define PCI_CFG_GPIO_HWRAD	0x20	/* PCI config space GPIO 13 for hw radio disable */
+#define PCI_CFG_GPIO_XTAL	0x40	/* PCI config space GPIO 14 for Xtal power-up */
+#define PCI_CFG_GPIO_PLL	0x80	/* PCI config space GPIO 15 for PLL power-down */
+
+/* power control defines */
+#define PLL_DELAY		150		/* us pll on delay */
+#define FREF_DELAY		200		/* us fref change delay */
+#define MIN_SLOW_CLK		32		/* us Slow clock period */
+#define	XTAL_ON_DELAY		1000		/* us crystal power-on delay */
+
+
+/* 43341 Boards */
 #define BCM943341WLABGS_SSID	0x062d
 
+/* 43342 Boards */
+#define BCM943342FCAGBI_SSID	0x0641
 
+/* # of GPIO pins */
 #define GPIO_NUMPINS		32
 
-
+/* These values are used by dhd host driver. */
 #define RDL_RAM_BASE_4319 0x60000000
 #define RDL_RAM_BASE_4329 0x60000000
 #define RDL_RAM_SIZE_4319 0x48000
@@ -464,13 +558,23 @@
 #define RDL_RAM_BASE_4328 0x80000000
 #define RDL_RAM_SIZE_4322 0x60000
 #define RDL_RAM_BASE_4322 0x60000000
-
-
+#define RDL_RAM_SIZE_4360  0xA0000
+#define RDL_RAM_BASE_4360  0x60000000
+#define RDL_RAM_SIZE_43242  0x90000
+#define RDL_RAM_BASE_43242  0x60000000
+#define RDL_RAM_SIZE_43143  0x70000
+#define RDL_RAM_BASE_43143  0x60000000
+#define RDL_RAM_SIZE_4350  0xC0000
+#define RDL_RAM_BASE_4350  0x180800
+
+/* generic defs for nvram "muxenab" bits
+* Note: these differ for 4335a0. refer bcmchipc.h for specific mux options.
+*/
 #define MUXENAB_UART		0x00000001
 #define MUXENAB_GPIO		0x00000002
-#define MUXENAB_ERCX		0x00000004	
+#define MUXENAB_ERCX		0x00000004	/* External Radio BT coex */
 #define MUXENAB_JTAG		0x00000008
-#define MUXENAB_HOST_WAKE	0x00000010	
+#define MUXENAB_HOST_WAKE	0x00000010	/* configure GPIO for SDIO host_wake */
 #define MUXENAB_I2S_EN		0x00000020
 #define MUXENAB_I2S_MASTER	0x00000040
 #define MUXENAB_I2S_FULL	0x00000080
@@ -480,10 +584,10 @@
 #define MUXENAB_RFSWCTRL2	0x00000800
 #define MUXENAB_SECI		0x00001000
 #define MUXENAB_BT_LEGACY	0x00002000
-#define MUXENAB_HOST_WAKE1	0x00004000	
-
+#define MUXENAB_HOST_WAKE1	0x00004000	/* configure alternative GPIO for SDIO host_wake */
 
+/* Boot flags */
 #define FLASH_KERNEL_NFLASH	0x00000001
 #define FLASH_BOOT_NFLASH	0x00000002
 
-#endif
+#endif /* _BCMDEVS_H */
diff --git a/bcmdhd/dhdutil/include/bcmendian.h b/bcmdhd/dhdutil/include/bcmendian.h
index e8f0a87..9af27bc 100644
--- a/bcmdhd/dhdutil/include/bcmendian.h
+++ b/bcmdhd/dhdutil/include/bcmendian.h
@@ -1,8 +1,8 @@
 /*
  * Byte order utilities
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,36 +15,38 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- *  $Id: bcmendian.h,v 1.36 2009-11-09 05:29:43 Exp $
+ *  $Id: bcmendian.h 241182 2011-02-17 21:50:03Z $
  *
  * This file by default provides proper behavior on little-endian architectures.
  * On big-endian architectures, IL_BIGENDIAN should be defined.
  */
 
-
 #ifndef _BCMENDIAN_H_
 #define _BCMENDIAN_H_
 
 #include <typedefs.h>
 
-
+/* Reverse the bytes in a 16-bit value */
 #define BCMSWAP16(val) \
 	((uint16)((((uint16)(val) & (uint16)0x00ffU) << 8) | \
 		  (((uint16)(val) & (uint16)0xff00U) >> 8)))
 
-
+/* Reverse the bytes in a 32-bit value */
 #define BCMSWAP32(val) \
 	((uint32)((((uint32)(val) & (uint32)0x000000ffU) << 24) | \
 		  (((uint32)(val) & (uint32)0x0000ff00U) <<  8) | \
 		  (((uint32)(val) & (uint32)0x00ff0000U) >>  8) | \
 		  (((uint32)(val) & (uint32)0xff000000U) >> 24)))
 
-
+/* Reverse the two 16-bit halves of a 32-bit value */
 #define BCMSWAP32BY16(val) \
 	((uint32)((((uint32)(val) & (uint32)0x0000ffffU) << 16) | \
 		  (((uint32)(val) & (uint32)0xffff0000U) >> 16)))
 
-
+/* Byte swapping macros
+ *    Host <=> Network (Big Endian) for 16- and 32-bit values
+ *    Host <=> Little-Endian for 16- and 32-bit values
+ */
 #ifndef hton16
 #define HTON16(i) BCMSWAP16(i)
 #define	hton16(i) bcmswap16(i)
@@ -62,12 +64,12 @@
 #define htol16(i) (i)
 #define HTOL32(i) (i)
 #define htol32(i) (i)
-#endif
+#endif /* hton16 */
 
 #define ltoh16_buf(buf, i)
 #define htol16_buf(buf, i)
 
-
+/* Unaligned loads and stores in host byte order */
 #define load32_ua(a)		ltoh32_ua(a)
 #define store32_ua(a, v)	htol32_ua_store(v, a)
 #define load16_ua(a)		ltoh16_ua(a)
@@ -92,7 +94,9 @@
 
 #ifdef __GNUC__
 
-
+/* GNU macro versions avoid referencing the argument multiple times, while also
+ * avoiding the -fno-inline used in ROM builds.
+ */
 
 #define bcmswap16(val) ({ \
 	uint16 _val = (val); \
@@ -170,9 +174,9 @@
 	_NTOH32_UA(_bytes); \
 })
 
-#else
-
+#else /* !__GNUC__ */
 
+/* Inline versions avoid referencing the argument multiple times */
 static INLINE uint16
 bcmswap16(uint16 val)
 {
@@ -191,9 +195,9 @@ bcmswap32by16(uint32 val)
 	return BCMSWAP32BY16(val);
 }
 
-
-
-
+/* Reverse pairs of bytes in a buffer (not for high-performance use) */
+/* buf	- start of buffer of shorts to swap */
+/* len  - byte length of buffer */
 static INLINE void
 bcmswap16_buf(uint16 *buf, uint len)
 {
@@ -205,7 +209,9 @@ bcmswap16_buf(uint16 *buf, uint len)
 	}
 }
 
-
+/*
+ * Store 16-bit value to unaligned little-endian byte array.
+ */
 static INLINE void
 htol16_ua_store(uint16 val, uint8 *bytes)
 {
@@ -213,7 +219,9 @@ htol16_ua_store(uint16 val, uint8 *bytes)
 	bytes[1] = val >> 8;
 }
 
-
+/*
+ * Store 32-bit value to unaligned little-endian byte array.
+ */
 static INLINE void
 htol32_ua_store(uint32 val, uint8 *bytes)
 {
@@ -223,7 +231,9 @@ htol32_ua_store(uint32 val, uint8 *bytes)
 	bytes[3] = val >> 24;
 }
 
-
+/*
+ * Store 16-bit value to unaligned network-(big-)endian byte array.
+ */
 static INLINE void
 hton16_ua_store(uint16 val, uint8 *bytes)
 {
@@ -231,7 +241,9 @@ hton16_ua_store(uint16 val, uint8 *bytes)
 	bytes[1] = val & 0xff;
 }
 
-
+/*
+ * Store 32-bit value to unaligned network-(big-)endian byte array.
+ */
 static INLINE void
 hton32_ua_store(uint32 val, uint8 *bytes)
 {
@@ -241,33 +253,41 @@ hton32_ua_store(uint32 val, uint8 *bytes)
 	bytes[3] = val & 0xff;
 }
 
-
+/*
+ * Load 16-bit value from unaligned little-endian byte array.
+ */
 static INLINE uint16
 ltoh16_ua(const void *bytes)
 {
 	return _LTOH16_UA((const uint8 *)bytes);
 }
 
-
+/*
+ * Load 32-bit value from unaligned little-endian byte array.
+ */
 static INLINE uint32
 ltoh32_ua(const void *bytes)
 {
 	return _LTOH32_UA((const uint8 *)bytes);
 }
 
-
+/*
+ * Load 16-bit value from unaligned big-(network-)endian byte array.
+ */
 static INLINE uint16
 ntoh16_ua(const void *bytes)
 {
 	return _NTOH16_UA((const uint8 *)bytes);
 }
 
-
+/*
+ * Load 32-bit value from unaligned big-(network-)endian byte array.
+ */
 static INLINE uint32
 ntoh32_ua(const void *bytes)
 {
 	return _NTOH32_UA((const uint8 *)bytes);
 }
 
-#endif
-#endif
+#endif /* !__GNUC__ */
+#endif /* !_BCMENDIAN_H_ */
diff --git a/bcmdhd/dhdutil/include/bcmutils.h b/bcmdhd/dhdutil/include/bcmutils.h
index a493c53..600ec0d 100644
--- a/bcmdhd/dhdutil/include/bcmutils.h
+++ b/bcmdhd/dhdutil/include/bcmutils.h
@@ -1,7 +1,7 @@
 /*
  * Misc useful os-independent macros and functions.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmutils.h 347624 2012-07-27 10:49:56Z $
+ * $Id: bcmutils.h 382763 2013-02-04 10:21:08Z $
  */
 
 #ifndef	_bcmutils_h_
@@ -33,15 +33,15 @@ extern "C" {
 #include <wlioctl.h>
 #endif
 
-
-#define _BCM_U	0x01
-#define _BCM_L	0x02
-#define _BCM_D	0x04
-#define _BCM_C	0x08
-#define _BCM_P	0x10
-#define _BCM_S	0x20
-#define _BCM_X	0x40
-#define _BCM_SP	0x80
+/* ctype replacement */
+#define _BCM_U	0x01	/* upper */
+#define _BCM_L	0x02	/* lower */
+#define _BCM_D	0x04	/* digit */
+#define _BCM_C	0x08	/* cntrl */
+#define _BCM_P	0x10	/* punct */
+#define _BCM_S	0x20	/* white space (space/lf/tab) */
+#define _BCM_X	0x40	/* hex digit */
+#define _BCM_SP	0x80	/* hard space (0x20) */
 
 extern const unsigned char bcm_ctype[];
 #define bcm_ismask(x)	(bcm_ctype[(int)(unsigned char)(x)])
@@ -60,22 +60,29 @@ extern const unsigned char bcm_ctype[];
 #define bcm_tolower(c)	(bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
 #define bcm_toupper(c)	(bcm_islower((c)) ? ((c) + 'A' - 'a') : (c))
 
-
+/* Buffer structure for collecting string-formatted data
+* using bcm_bprintf() API.
+* Use bcm_binit() to initialize before use
+*/
 
 struct bcmstrbuf {
-	char *buf;
-	unsigned int size;
-	char *origbuf;
-	unsigned int origsize;
+	char *buf;	/* pointer to current position in origbuf */
+	unsigned int size;	/* current (residual) size in bytes */
+	char *origbuf;	/* unmodified pointer to orignal buffer */
+	unsigned int origsize;	/* unmodified orignal buffer size in bytes */
 };
 
-
+/* ** driver-only section ** */
 #ifdef BCMDRIVER
 #include <osl.h>
 
-#define GPIO_PIN_NOTDEFINED 	0x20
-
+#define GPIO_PIN_NOTDEFINED 	0x20	/* Pin not defined */
 
+/*
+ * Spin at most 'us' microseconds while 'exp' is true.
+ * Caller should explicitly test 'exp' when this completes
+ * and take appropriate error action if 'exp' is still true.
+ */
 #define SPINWAIT(exp, us) { \
 	uint countdown = (us) + 9; \
 	while ((exp) && (countdown >= 10)) {\
@@ -84,84 +91,96 @@ struct bcmstrbuf {
 	} \
 }
 
-
+/* osl multi-precedence packet queue */
 #ifndef PKTQ_LEN_DEFAULT
-#define PKTQ_LEN_DEFAULT        128
+#define PKTQ_LEN_DEFAULT        128	/* Max 128 packets */
 #endif
 #ifndef PKTQ_MAX_PREC
-#define PKTQ_MAX_PREC           16
+#define PKTQ_MAX_PREC           16	/* Maximum precedence levels */
 #endif
 
 typedef struct pktq_prec {
-	void *head;
-	void *tail;
-	uint16 len;
-	uint16 max;
+	void *head;     /* first packet to dequeue */
+	void *tail;     /* last packet to dequeue */
+	uint16 len;     /* number of queued packets */
+	uint16 max;     /* maximum number of queued packets */
 } pktq_prec_t;
 
 #ifdef PKTQ_LOG
 typedef struct {
-	uint32 requested;    
-	uint32 stored;	     
-	uint32 saved;	     
-	uint32 selfsaved;    
-	uint32 full_dropped; 
-	uint32 dropped;      
-	uint32 sacrificed;   
-	uint32 busy;         
-	uint32 retry;        
-	uint32 ps_retry;     
-	uint32 retry_drop;   
-	uint32 max_avail;    
-	uint32 max_used;     
-	uint32 queue_capacity; 
+	uint32 requested;    /* packets requested to be stored */
+	uint32 stored;	     /* packets stored */
+	uint32 saved;	     /* packets saved,
+	                            because a lowest priority queue has given away one packet
+	                      */
+	uint32 selfsaved;    /* packets saved,
+	                            because an older packet from the same queue has been dropped
+	                      */
+	uint32 full_dropped; /* packets dropped,
+	                            because pktq is full with higher precedence packets
+	                      */
+	uint32 dropped;      /* packets dropped because pktq per that precedence is full */
+	uint32 sacrificed;   /* packets dropped,
+	                            in order to save one from a queue of a highest priority
+	                      */
+	uint32 busy;         /* packets droped because of hardware/transmission error */
+	uint32 retry;        /* packets re-sent because they were not received */
+	uint32 ps_retry;     /* packets retried again prior to moving power save mode */
+	uint32 retry_drop;   /* packets finally dropped after retry limit */
+	uint32 max_avail;    /* the high-water mark of the queue capacity for packets -
+	                            goes to zero as queue fills
+	                      */
+	uint32 max_used;     /* the high-water mark of the queue utilisation for packets -
+						        increases with use ('inverse' of max_avail)
+				          */
+	uint32 queue_capacity; /* the maximum capacity of the queue */
+	uint32 rtsfail;        /* count of rts attempts that failed to receive cts */
+	uint32 acked;          /* count of packets sent (acked) successfully */
 } pktq_counters_t;
-#endif 
+#endif /* PKTQ_LOG */
 
 
 #define PKTQ_COMMON	\
-	uint16 num_prec;        			\
-	uint16 hi_prec;         	\
-	uint16 max;             					\
-	uint16 len;             
-
+	uint16 num_prec;        /* number of precedences in use */			\
+	uint16 hi_prec;         /* rapid dequeue hint (>= highest non-empty prec) */	\
+	uint16 max;             /* total max packets */					\
+	uint16 len;             /* total number of packets */
 
+/* multi-priority pkt queue */
 struct pktq {
 	PKTQ_COMMON
-	
+	/* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
 	struct pktq_prec q[PKTQ_MAX_PREC];
 #ifdef PKTQ_LOG
-	pktq_counters_t	_prec_cnt[PKTQ_MAX_PREC];		
+	pktq_counters_t	_prec_cnt[PKTQ_MAX_PREC];     /* Counters per queue  */
+	pktq_counters_t _prec_bytes[PKTQ_MAX_PREC];   /* Byte count per queue  */
+	uint32 _logtime;                   /* timestamp of last counter clear  */
 #endif
 };
 
-
+/* simple, non-priority pkt queue */
 struct spktq {
 	PKTQ_COMMON
-	
+	/* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
 	struct pktq_prec q[1];
 };
 
 #define PKTQ_PREC_ITER(pq, prec)        for (prec = (pq)->num_prec - 1; prec >= 0; prec--)
 
-
+/* fn(pkt, arg).  return true if pkt belongs to if */
 typedef bool (*ifpkt_cb_t)(void*, int);
 
 #ifdef BCMPKTPOOL
 #define POOL_ENAB(pool)		((pool) && (pool)->inited)
-#if defined(BCM4329C0)
-#define SHARED_POOL		(pktpool_shared_ptr)
-#else
 #define SHARED_POOL		(pktpool_shared)
-#endif
-#else
+#else /* BCMPKTPOOL */
 #define POOL_ENAB(bus)		0
 #define SHARED_POOL		((struct pktpool *)NULL)
-#endif
+#endif /* BCMPKTPOOL */
 
 #ifndef PKTPOOL_LEN_MAX
 #define PKTPOOL_LEN_MAX		40
-#endif 
+#endif /* PKTPOOL_LEN_MAX */
 #define PKTPOOL_CB_MAX		3
 
 struct pktpool;
@@ -172,7 +191,7 @@ typedef struct {
 } pktpool_cbinfo_t;
 
 #ifdef BCMDBG_POOL
-
+/* pkt pool debug states */
 #define POOL_IDLE	0
 #define POOL_RXFILL	1
 #define POOL_RXDH	2
@@ -189,15 +208,15 @@ typedef struct {
 } pktpool_dbg_t;
 
 typedef struct {
-	uint8 txdh;
-	uint8 txd11;
-	uint8 enq;
-	uint8 rxdh;
-	uint8 rxd11;
-	uint8 rxfill;
-	uint8 idle;
+	uint8 txdh;	/* tx to host */
+	uint8 txd11;	/* tx to d11 */
+	uint8 enq;	/* waiting in q */
+	uint8 rxdh;	/* rx from host */
+	uint8 rxd11;	/* rx from d11 */
+	uint8 rxfill;	/* dma_rxfill */
+	uint8 idle;	/* avail in pool */
 } pktpool_stats_t;
-#endif
+#endif /* BCMDBG_POOL */
 
 typedef struct pktpool {
 	bool inited;
@@ -225,11 +244,7 @@ typedef struct pktpool {
 #endif
 } pktpool_t;
 
-#if defined(BCM4329C0)
-extern pktpool_t *pktpool_shared_ptr;
-#else
 extern pktpool_t *pktpool_shared;
-#endif
 
 extern int pktpool_init(osl_t *osh, pktpool_t *pktp, int *pktplen, int plen, bool istx);
 extern int pktpool_deinit(osl_t *osh, pktpool_t *pktp);
@@ -258,16 +273,16 @@ extern int pktpool_start_trigger(pktpool_t *pktp, void *p);
 extern int pktpool_dbg_dump(pktpool_t *pktp);
 extern int pktpool_dbg_notify(pktpool_t *pktp);
 extern int pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats);
-#endif
-
+#endif /* BCMDBG_POOL */
 
+/* forward definition of ether_addr structure used by some function prototypes */
 
 struct ether_addr;
 
 extern int ether_isbcast(const void *ea);
 extern int ether_isnulladdr(const void *ea);
 
-
+/* operations on a specific precedence in packet queue */
 
 #define pktq_psetmax(pq, prec, _max)	((pq)->q[prec].max = (_max))
 #define pktq_pmax(pq, prec)		((pq)->q[prec].max)
@@ -283,20 +298,21 @@ extern void *pktq_penq(struct pktq *pq, int prec, void *p);
 extern void *pktq_penq_head(struct pktq *pq, int prec, void *p);
 extern void *pktq_pdeq(struct pktq *pq, int prec);
 extern void *pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p);
+extern void *pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg);
 extern void *pktq_pdeq_tail(struct pktq *pq, int prec);
-
+/* Empty the queue at particular precedence level */
 extern void pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir,
 	ifpkt_cb_t fn, int arg);
-
+/* Remove a specified packet from its queue */
 extern bool pktq_pdel(struct pktq *pq, void *p, int prec);
 
-
+/* operations on a set of precedences in packet queue */
 
 extern int pktq_mlen(struct pktq *pq, uint prec_bmp);
 extern void *pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
 extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
 
-
+/* operations on packet queue as a whole */
 
 #define pktq_len(pq)		((int)(pq)->len)
 #define pktq_max(pq)		((int)(pq)->max)
@@ -304,7 +320,7 @@ extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
 #define pktq_full(pq)		((pq)->len >= (pq)->max)
 #define pktq_empty(pq)		((pq)->len == 0)
 
-
+/* operations for single precedence queues */
 #define pktenq(pq, p)		pktq_penq(((struct pktq *)(void *)pq), 0, (p))
 #define pktenq_head(pq, p)	pktq_penq_head(((struct pktq *)(void *)pq), 0, (p))
 #define pktdeq(pq)		pktq_pdeq(((struct pktq *)(void *)pq), 0)
@@ -314,32 +330,33 @@ extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
 extern void pktq_init(struct pktq *pq, int num_prec, int max_len);
 extern void pktq_set_max_plen(struct pktq *pq, int prec, int max_len);
 
-
+/* prec_out may be NULL if caller is not interested in return value */
 extern void *pktq_deq(struct pktq *pq, int *prec_out);
 extern void *pktq_deq_tail(struct pktq *pq, int *prec_out);
 extern void *pktq_peek(struct pktq *pq, int *prec_out);
 extern void *pktq_peek_tail(struct pktq *pq, int *prec_out);
 extern void pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg);
 
-
-
+/* externs */
+/* packet */
 extern uint pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf);
 extern uint pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf);
 extern uint pkttotlen(osl_t *osh, void *p);
 extern void *pktlast(osl_t *osh, void *p);
 extern uint pktsegcnt(osl_t *osh, void *p);
 extern uint pktsegcnt_war(osl_t *osh, void *p);
-extern uint8 *pktoffset(osl_t *osh, void *p,  uint offset);
-
+extern uint8 *pktdataoffset(osl_t *osh, void *p,  uint offset);
+extern void *pktoffset(osl_t *osh, void *p,  uint offset);
 
-#define	PKTPRIO_VDSCP	0x100		
-#define	PKTPRIO_VLAN	0x200		
-#define	PKTPRIO_UPD	0x400		
-#define	PKTPRIO_DSCP	0x800		
+/* Get priority from a packet and pass it back in scb (or equiv) */
+#define	PKTPRIO_VDSCP	0x100		/* DSCP prio found after VLAN tag */
+#define	PKTPRIO_VLAN	0x200		/* VLAN prio found */
+#define	PKTPRIO_UPD	0x400		/* DSCP used to update VLAN prio */
+#define	PKTPRIO_DSCP	0x800		/* DSCP prio found */
 
 extern uint pktsetprio(void *pkt, bool update_vtag);
 
-
+/* string */
 extern int bcm_atoi(const char *s);
 extern ulong bcm_strtoul(const char *cp, char **endp, uint base);
 extern char *bcmstrstr(const char *haystack, const char *needle);
@@ -351,17 +368,17 @@ int bcmstricmp(const char *s1, const char *s2);
 int bcmstrnicmp(const char* s1, const char* s2, int cnt);
 
 
-
+/* ethernet address */
 extern char *bcm_ether_ntoa(const struct ether_addr *ea, char *buf);
 extern int bcm_ether_atoe(const char *p, struct ether_addr *ea);
 
-
+/* ip address */
 struct ipv4_addr;
 extern char *bcm_ip_ntoa(struct ipv4_addr *ia, char *buf);
 
-
+/* delay */
 extern void bcm_mdelay(uint ms);
-
+/* variable access */
 #define NVRAM_RECLAIM_CHECK(name)
 
 extern char *getvar(char *vars, const char *name);
@@ -383,52 +400,57 @@ extern uint getgpiopin(char *vars, char *pin_name, uint def_pin);
 extern char *bcm_nvram_vars(uint *length);
 extern int bcm_nvram_cache(void *sih);
 
+/* Support for sharing code across in-driver iovar implementations.
+ * The intent is that a driver use this structure to map iovar names
+ * to its (private) iovar identifiers, and the lookup function to
+ * find the entry.  Macros are provided to map ids and get/set actions
+ * into a single number space for a switch statement.
+ */
 
-
-
+/* iovar structure */
 typedef struct bcm_iovar {
-	const char *name;
-	uint16 varid;
-	uint16 flags;
-	uint16 type;
-	uint16 minlen;
+	const char *name;	/* name for lookup and display */
+	uint16 varid;		/* id for switch */
+	uint16 flags;		/* driver-specific flag bits */
+	uint16 type;		/* base type of argument */
+	uint16 minlen;		/* min length for buffer vars */
 } bcm_iovar_t;
 
+/* varid definitions are per-driver, may use these get/set bits */
 
+/* IOVar action bits for id mapping */
+#define IOV_GET 0 /* Get an iovar */
+#define IOV_SET 1 /* Set an iovar */
 
-
-#define IOV_GET 0
-#define IOV_SET 1
-
-
-#define IOV_GVAL(id)		((id)*2)
+/* Varid to actionid mapping */
+#define IOV_GVAL(id)		((id) * 2)
 #define IOV_SVAL(id)		((id) * 2 + IOV_SET)
 #define IOV_ISSET(actionid)	((actionid & IOV_SET) == IOV_SET)
 #define IOV_ID(actionid)	(actionid >> 1)
 
-
+/* flags are per-driver based on driver attributes */
 
 extern const bcm_iovar_t *bcm_iovar_lookup(const bcm_iovar_t *table, const char *name);
 extern int bcm_iovar_lencheck(const bcm_iovar_t *table, void *arg, int len, bool set);
 #if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
 	defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
 extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
-#endif
-#endif
-
-
-#define IOVT_VOID	0
-#define IOVT_BOOL	1
-#define IOVT_INT8	2
-#define IOVT_UINT8	3
-#define IOVT_INT16	4
-#define IOVT_UINT16	5
-#define IOVT_INT32	6
-#define IOVT_UINT32	7
-#define IOVT_BUFFER	8
+#endif 
+#endif	/* BCMDRIVER */
+
+/* Base type definitions */
+#define IOVT_VOID	0	/* no value (implictly set only) */
+#define IOVT_BOOL	1	/* any value ok (zero/nonzero) */
+#define IOVT_INT8	2	/* integer values are range-checked */
+#define IOVT_UINT8	3	/* unsigned int 8 bits */
+#define IOVT_INT16	4	/* int 16 bits */
+#define IOVT_UINT16	5	/* unsigned int 16 bits */
+#define IOVT_INT32	6	/* int 32 bits */
+#define IOVT_UINT32	7	/* unsigned int 32 bits */
+#define IOVT_BUFFER	8	/* buffer is size-checked as per minlen */
 #define BCM_IOVT_VALID(type) (((unsigned int)(type)) <= IOVT_BUFFER)
 
-
+/* Initializer for IOV type strings */
 #define BCM_IOV_TYPE_INIT { \
 	"void", \
 	"bool", \
@@ -450,60 +472,70 @@ extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
 	(type == IOVT_INT32) || \
 	(type == IOVT_UINT32))
 
+/* ** driver/apps-shared section ** */
 
-
-#define BCME_STRLEN 		64
+#define BCME_STRLEN 		64	/* Max string length for BCM errors */
 #define VALID_BCMERROR(e)  ((e <= 0) && (e >= BCME_LAST))
 
 
-
-
-#define BCME_OK				0
-#define BCME_ERROR			-1
-#define BCME_BADARG			-2
-#define BCME_BADOPTION			-3
-#define BCME_NOTUP			-4
-#define BCME_NOTDOWN			-5
-#define BCME_NOTAP			-6
-#define BCME_NOTSTA			-7
-#define BCME_BADKEYIDX			-8
-#define BCME_RADIOOFF 			-9
-#define BCME_NOTBANDLOCKED		-10
-#define BCME_NOCLK			-11
-#define BCME_BADRATESET			-12
-#define BCME_BADBAND			-13
-#define BCME_BUFTOOSHORT		-14
-#define BCME_BUFTOOLONG			-15
-#define BCME_BUSY			-16
-#define BCME_NOTASSOCIATED		-17
-#define BCME_BADSSIDLEN			-18
-#define BCME_OUTOFRANGECHAN		-19
-#define BCME_BADCHAN			-20
-#define BCME_BADADDR			-21
-#define BCME_NORESOURCE			-22
-#define BCME_UNSUPPORTED		-23
-#define BCME_BADLEN			-24
-#define BCME_NOTREADY			-25
-#define BCME_EPERM			-26
-#define BCME_NOMEM			-27
-#define BCME_ASSOCIATED			-28
-#define BCME_RANGE			-29
-#define BCME_NOTFOUND			-30
-#define BCME_WME_NOT_ENABLED		-31
-#define BCME_TSPEC_NOTFOUND		-32
-#define BCME_ACM_NOTSUPPORTED		-33
-#define BCME_NOT_WME_ASSOCIATION	-34
-#define BCME_SDIO_ERROR			-35
-#define BCME_DONGLE_DOWN		-36
-#define BCME_VERSION			-37
-#define BCME_TXFAIL			-38
-#define BCME_RXFAIL			-39
-#define BCME_NODEVICE			-40
-#define BCME_NMODE_DISABLED		-41
-#define BCME_NONRESIDENT		-42
-#define BCME_LAST			BCME_NONRESIDENT
-
-
+/*
+ * error codes could be added but the defined ones shouldn't be changed/deleted
+ * these error codes are exposed to the user code
+ * when ever a new error code is added to this list
+ * please update errorstring table with the related error string and
+ * update osl files with os specific errorcode map
+*/
+
+#define BCME_OK				0	/* Success */
+#define BCME_ERROR			-1	/* Error generic */
+#define BCME_BADARG			-2	/* Bad Argument */
+#define BCME_BADOPTION			-3	/* Bad option */
+#define BCME_NOTUP			-4	/* Not up */
+#define BCME_NOTDOWN			-5	/* Not down */
+#define BCME_NOTAP			-6	/* Not AP */
+#define BCME_NOTSTA			-7	/* Not STA  */
+#define BCME_BADKEYIDX			-8	/* BAD Key Index */
+#define BCME_RADIOOFF 			-9	/* Radio Off */
+#define BCME_NOTBANDLOCKED		-10	/* Not  band locked */
+#define BCME_NOCLK			-11	/* No Clock */
+#define BCME_BADRATESET			-12	/* BAD Rate valueset */
+#define BCME_BADBAND			-13	/* BAD Band */
+#define BCME_BUFTOOSHORT		-14	/* Buffer too short */
+#define BCME_BUFTOOLONG			-15	/* Buffer too long */
+#define BCME_BUSY			-16	/* Busy */
+#define BCME_NOTASSOCIATED		-17	/* Not Associated */
+#define BCME_BADSSIDLEN			-18	/* Bad SSID len */
+#define BCME_OUTOFRANGECHAN		-19	/* Out of Range Channel */
+#define BCME_BADCHAN			-20	/* Bad Channel */
+#define BCME_BADADDR			-21	/* Bad Address */
+#define BCME_NORESOURCE			-22	/* Not Enough Resources */
+#define BCME_UNSUPPORTED		-23	/* Unsupported */
+#define BCME_BADLEN			-24	/* Bad length */
+#define BCME_NOTREADY			-25	/* Not Ready */
+#define BCME_EPERM			-26	/* Not Permitted */
+#define BCME_NOMEM			-27	/* No Memory */
+#define BCME_ASSOCIATED			-28	/* Associated */
+#define BCME_RANGE			-29	/* Not In Range */
+#define BCME_NOTFOUND			-30	/* Not Found */
+#define BCME_WME_NOT_ENABLED		-31	/* WME Not Enabled */
+#define BCME_TSPEC_NOTFOUND		-32	/* TSPEC Not Found */
+#define BCME_ACM_NOTSUPPORTED		-33	/* ACM Not Supported */
+#define BCME_NOT_WME_ASSOCIATION	-34	/* Not WME Association */
+#define BCME_SDIO_ERROR			-35	/* SDIO Bus Error */
+#define BCME_DONGLE_DOWN		-36	/* Dongle Not Accessible */
+#define BCME_VERSION			-37 	/* Incorrect version */
+#define BCME_TXFAIL			-38 	/* TX failure */
+#define BCME_RXFAIL			-39	/* RX failure */
+#define BCME_NODEVICE			-40 	/* Device not present */
+#define BCME_NMODE_DISABLED		-41 	/* NMODE disabled */
+#define BCME_NONRESIDENT		-42 /* access to nonresident overlay */
+#define BCME_SCANREJECT			-43 	/* reject scan request */
+#define BCME_USAGE_ERROR                -44     /* WLCMD usage error */
+#define BCME_IOCTL_ERROR                -45     /* WLCMD ioctl error */
+#define BCME_SERIAL_PORT_ERR            -46     /* RWL serial port error */
+#define BCME_LAST			BCME_SERIAL_PORT_ERR
+
+/* These are collection of BCME Error strings */
 #define BCMERRSTRINGTABLE {		\
 	"OK",				\
 	"Undefined error",		\
@@ -548,23 +580,45 @@ extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
 	"Device Not Present",		\
 	"NMODE Disabled",		\
 	"Nonresident overlay access", \
+	"Scan Rejected",		\
+	"WLCMD usage error",		\
+	"WLCMD ioctl error",		\
+	"RWL serial port error", 	\
 }
 
 #ifndef ABS
-#define	ABS(a)			(((a) < 0)?-(a):(a))
-#endif
+#define	ABS(a)			(((a) < 0) ? -(a) : (a))
+#endif /* ABS */
 
 #ifndef MIN
-#define	MIN(a, b)		(((a) < (b))?(a):(b))
-#endif
+#define	MIN(a, b)		(((a) < (b)) ? (a) : (b))
+#endif /* MIN */
 
 #ifndef MAX
-#define	MAX(a, b)		(((a) > (b))?(a):(b))
-#endif
-
-#define CEIL(x, y)		(((x) + ((y)-1)) / (y))
-#define	ROUNDUP(x, y)		((((x)+((y)-1))/(y))*(y))
-#define	ISALIGNED(a, x)		(((uintptr)(a) & ((x)-1)) == 0)
+#define	MAX(a, b)		(((a) > (b)) ? (a) : (b))
+#endif /* MAX */
+
+/* limit to [min, max] */
+#ifndef LIMIT_TO_RANGE
+#define LIMIT_TO_RANGE(x, min, max) \
+	((x) < (min) ? (min) : ((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_RANGE */
+
+/* limit to  max */
+#ifndef LIMIT_TO_MAX
+#define LIMIT_TO_MAX(x, max) \
+	(((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_MAX */
+
+/* limit to min */
+#ifndef LIMIT_TO_MIN
+#define LIMIT_TO_MIN(x, min) \
+	(((x) < (min) ? (min) : (x)))
+#endif /* LIMIT_TO_MIN */
+
+#define CEIL(x, y)		(((x) + ((y) - 1)) / (y))
+#define	ROUNDUP(x, y)		((((x) + ((y) - 1)) / (y)) * (y))
+#define	ISALIGNED(a, x)		(((uintptr)(a) & ((x) - 1)) == 0)
 #define ALIGN_ADDR(addr, boundary) (void *)(((uintptr)(addr) + (boundary) - 1) \
 	                                         & ~((boundary) - 1))
 #define ALIGN_SIZE(size, boundary) (((size) + (boundary) - 1) \
@@ -574,32 +628,49 @@ extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
 
 #ifndef OFFSETOF
 #ifdef __ARMCC_VERSION
-
+/*
+ * The ARM RVCT compiler complains when using OFFSETOF where a constant
+ * expression is expected, such as an initializer for a static object.
+ * offsetof from the runtime library doesn't have that problem.
+ */
 #include <stddef.h>
 #define	OFFSETOF(type, member)	offsetof(type, member)
 #else
 #define	OFFSETOF(type, member)	((uint)(uintptr)&((type *)0)->member)
-#endif 
-#endif 
+#endif /* __ARMCC_VERSION */
+#endif /* OFFSETOF */
 
 #ifndef ARRAYSIZE
-#define ARRAYSIZE(a)		(sizeof(a)/sizeof(a[0]))
+#define ARRAYSIZE(a)		(sizeof(a) / sizeof(a[0]))
 #endif
 
+#ifndef ARRAYLAST     /* returns pointer to last array element */
+#define ARRAYLAST(a)		(&a[ARRAYSIZE(a)-1])
+#endif
 
+/* Reference a function; used to prevent a static function from being optimized out */
 extern void *_bcmutils_dummy_fn;
 #define REFERENCE_FUNCTION(f)	(_bcmutils_dummy_fn = (void *)(f))
 
-
+/* bit map related macros */
 #ifndef setbit
-#ifndef NBBY
-#define	NBBY	8
-#endif
-#define	setbit(a, i)	(((uint8 *)a)[(i)/NBBY] |= 1<<((i)%NBBY))
-#define	clrbit(a, i)	(((uint8 *)a)[(i)/NBBY] &= ~(1<<((i)%NBBY)))
-#define	isset(a, i)	(((const uint8 *)a)[(i)/NBBY] & (1<<((i)%NBBY)))
-#define	isclr(a, i)	((((const uint8 *)a)[(i)/NBBY] & (1<<((i)%NBBY))) == 0)
+#ifndef NBBY		    /* the BSD family defines NBBY */
+#define	NBBY	8	/* 8 bits per byte */
+#endif /* #ifndef NBBY */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+extern void setbit(void *array, uint bit);
+extern void clrbit(void *array, uint bit);
+extern bool isset(const void *array, uint bit);
+extern bool isclr(const void *array, uint bit);
+#else
+#define	setbit(a, i)	(((uint8 *)a)[(i) / NBBY] |= 1 << ((i) % NBBY))
+#define	clrbit(a, i)	(((uint8 *)a)[(i) / NBBY] &= ~(1 << ((i) % NBBY)))
+#define	isset(a, i)	(((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY)))
+#define	isclr(a, i)	((((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY))) == 0)
 #endif
+#endif /* setbit */
+
+#define	isbitset(a, i)	(((a) & (1 << (i))) != 0)
 
 #define	NBITS(type)	(sizeof(type) * 8)
 #define NBITVAL(nbits)	(1 << (nbits))
@@ -607,36 +678,36 @@ extern void *_bcmutils_dummy_fn;
 #define	NBITMASK(nbits)	MAXBITVAL(nbits)
 #define MAXNBVAL(nbyte)	MAXBITVAL((nbyte) * 8)
 
-
+/* basic mux operation - can be optimized on several architectures */
 #define MUX(pred, true, false) ((pred) ? (true) : (false))
 
-
+/* modulo inc/dec - assumes x E [0, bound - 1] */
 #define MODDEC(x, bound) MUX((x) == 0, (bound) - 1, (x) - 1)
 #define MODINC(x, bound) MUX((x) == (bound) - 1, 0, (x) + 1)
 
-
+/* modulo inc/dec, bound = 2^k */
 #define MODDEC_POW2(x, bound) (((x) - 1) & ((bound) - 1))
 #define MODINC_POW2(x, bound) (((x) + 1) & ((bound) - 1))
 
-
+/* modulo add/sub - assumes x, y E [0, bound - 1] */
 #define MODADD(x, y, bound) \
     MUX((x) + (y) >= (bound), (x) + (y) - (bound), (x) + (y))
 #define MODSUB(x, y, bound) \
     MUX(((int)(x)) - ((int)(y)) < 0, (x) - (y) + (bound), (x) - (y))
 
-
+/* module add/sub, bound = 2^k */
 #define MODADD_POW2(x, y, bound) (((x) + (y)) & ((bound) - 1))
 #define MODSUB_POW2(x, y, bound) (((x) - (y)) & ((bound) - 1))
 
+/* crc defines */
+#define CRC8_INIT_VALUE  0xff		/* Initial CRC8 checksum value */
+#define CRC8_GOOD_VALUE  0x9f		/* Good final CRC8 checksum value */
+#define CRC16_INIT_VALUE 0xffff		/* Initial CRC16 checksum value */
+#define CRC16_GOOD_VALUE 0xf0b8		/* Good final CRC16 checksum value */
+#define CRC32_INIT_VALUE 0xffffffff	/* Initial CRC32 checksum value */
+#define CRC32_GOOD_VALUE 0xdebb20e3	/* Good final CRC32 checksum value */
 
-#define CRC8_INIT_VALUE  0xff
-#define CRC8_GOOD_VALUE  0x9f
-#define CRC16_INIT_VALUE 0xffff
-#define CRC16_GOOD_VALUE 0xf0b8
-#define CRC32_INIT_VALUE 0xffffffff
-#define CRC32_GOOD_VALUE 0xdebb20e3
-
-
+/* use for direct output of MAC address in printf etc */
 #define MACF				"%02x:%02x:%02x:%02x:%02x:%02x"
 #define ETHERP_TO_MACF(ea)	((struct ether_addr *) (ea))->octet[0], \
 							((struct ether_addr *) (ea))->octet[1], \
@@ -651,27 +722,42 @@ extern void *_bcmutils_dummy_fn;
 							(ea).octet[3], \
 							(ea).octet[4], \
 							(ea).octet[5]
+#if !defined(SIMPLE_MAC_PRINT)
+#define MACDBG "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC2STRDBG(ea) (ea)[0], (ea)[1], (ea)[2], (ea)[3], (ea)[4], (ea)[5]
+#else
+#define MACDBG				"%02x:%02x:%02x"
+#define MAC2STRDBG(ea) (ea)[0], (ea)[4], (ea)[5]
+#endif /* SIMPLE_MAC_PRINT */
 
+/* bcm_format_flags() bit description structure */
 typedef struct bcm_bit_desc {
 	uint32	bit;
 	const char* name;
 } bcm_bit_desc_t;
 
+/* bcm_format_field */
+typedef struct bcm_bit_desc_ex {
+	uint32 mask;
+	const bcm_bit_desc_t *bitfield;
+} bcm_bit_desc_ex_t;
 
+
+/* tag_ID/length/value_buffer tuple */
 typedef struct bcm_tlv {
 	uint8	id;
 	uint8	len;
 	uint8	data[1];
 } bcm_tlv_t;
 
-
+/* Check that bcm_tlv_t fits into the given buflen */
 #define bcm_valid_tlv(elt, buflen) ((buflen) >= 2 && (int)(buflen) >= (int)(2 + (elt)->len))
 
+/* buffer length for ethernet address from bcm_ether_ntoa() */
+#define ETHER_ADDR_STR_LEN	18	/* 18-bytes of Ethernet address buffer length */
 
-#define ETHER_ADDR_STR_LEN	18
-
-
-
+/* crypto utility function */
+/* 128-bit xor: *dst = *src1 xor *src2. dst1, src1 and src2 may have any alignment */
 static INLINE void
 xor_128bit_block(const uint8 *src1, const uint8 *src2, uint8 *dst)
 {
@@ -680,28 +766,32 @@ xor_128bit_block(const uint8 *src1, const uint8 *src2, uint8 *dst)
 	    1 ||
 #endif
 	    (((uintptr)src1 | (uintptr)src2 | (uintptr)dst) & 3) == 0) {
-
-
+		/* ARM CM3 rel time: 1229 (727 if alignment check could be omitted) */
+		/* x86 supports unaligned.  This version runs 6x-9x faster on x86. */
 		((uint32 *)dst)[0] = ((const uint32 *)src1)[0] ^ ((const uint32 *)src2)[0];
 		((uint32 *)dst)[1] = ((const uint32 *)src1)[1] ^ ((const uint32 *)src2)[1];
 		((uint32 *)dst)[2] = ((const uint32 *)src1)[2] ^ ((const uint32 *)src2)[2];
 		((uint32 *)dst)[3] = ((const uint32 *)src1)[3] ^ ((const uint32 *)src2)[3];
 	} else {
-
+		/* ARM CM3 rel time: 4668 (4191 if alignment check could be omitted) */
 		int k;
 		for (k = 0; k < 16; k++)
 			dst[k] = src1[k] ^ src2[k];
 	}
 }
 
-
-
+/* externs */
+/* crc */
 extern uint8 hndcrc8(uint8 *p, uint nbytes, uint8 crc);
 extern uint16 hndcrc16(uint8 *p, uint nbytes, uint16 crc);
 extern uint32 hndcrc32(uint8 *p, uint nbytes, uint32 crc);
 
+/* format/print */
 #if defined(DHD_DEBUG) || defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || \
 	defined(WLMSG_ASSOC)
+/* print out the value a field has: fields may have 1-32 bits and may hold any value */
+extern int bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 field, char* buf, int len);
+/* print out which bits in flags are set */
 extern int bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len);
 #endif
 
@@ -716,23 +806,23 @@ extern char *bcm_brev_str(uint32 brev, char *buf);
 extern void printbig(char *buf);
 extern void prhex(const char *msg, uchar *buf, uint len);
 
-
+/* IE parsing */
 extern bcm_tlv_t *bcm_next_tlv(bcm_tlv_t *elt, int *buflen);
 extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
 extern bcm_tlv_t *bcm_parse_ordered_tlvs(void *buf, int buflen, uint key);
 
-
+/* bcmerror */
 extern const char *bcmerrorstr(int bcmerror);
-extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
-
+/* extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key); */
 
+/* multi-bool data type: set of bools, mbool is true if any is set */
 typedef uint32 mbool;
-#define mboolset(mb, bit)		((mb) |= (bit))		
-#define mboolclr(mb, bit)		((mb) &= ~(bit))	
-#define mboolisset(mb, bit)		(((mb) & (bit)) != 0)	
+#define mboolset(mb, bit)		((mb) |= (bit))		/* set one bool */
+#define mboolclr(mb, bit)		((mb) &= ~(bit))	/* clear one bool */
+#define mboolisset(mb, bit)		(((mb) & (bit)) != 0)	/* TRUE if one bool is set */
 #define	mboolmaskset(mb, mask, val)	((mb) = (((mb) & ~(mask)) | (val)))
 
-
+/* generic datastruct to help dump routines */
 struct fielddesc {
 	const char *nameandfmt;
 	uint32 	offset;
@@ -753,15 +843,22 @@ extern uint bcm_bitcount(uint8 *bitmap, uint bytelength);
 
 extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
 
-
+/* power conversion */
 extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
 extern uint8 bcm_mw_to_qdbm(uint16 mw);
 extern uint bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint len);
 
 unsigned int process_nvram_vars(char *varbuf, unsigned int len);
+extern bcm_tlv_t *find_vendor_ie(void *tlvs, int tlvs_len,
+	const char *voui, uint8 *type, int type_len);
+
+/* calculate a * b + c */
+extern void bcm_uint64_multiple_add(uint32* r_high, uint32* r_low, uint32 a, uint32 b, uint32 c);
+/* calculate a / b */
+extern void bcm_uint64_divide(uint32* r, uint32 a_high, uint32 a_low, uint32 b);
 
 #ifdef __cplusplus
 	}
 #endif
 
-#endif
+#endif	/* _bcmutils_h_ */
diff --git a/bcmdhd/dhdutil/include/bcmwifi.h b/bcmdhd/dhdutil/include/bcmwifi.h
deleted file mode 100644
index 47c67a5..0000000
--- a/bcmdhd/dhdutil/include/bcmwifi.h
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Misc utility routines for WL and Apps
- * This header file housing the define and function prototype use by
- * both the wl driver, tools & Apps.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * $Id: bcmwifi.h,v 1.29.6.3 2010-08-03 17:47:04 Exp $
- */
-
-
-#ifndef	_bcmwifi_h_
-#define	_bcmwifi_h_
-
-
-
-typedef uint16 chanspec_t;
-
-
-#define CH_UPPER_SB			0x01
-#define CH_LOWER_SB			0x02
-#define CH_EWA_VALID			0x04
-#define CH_20MHZ_APART			4
-#define CH_10MHZ_APART			2
-#define CH_5MHZ_APART			1
-#define CH_MAX_2G_CHANNEL		14
-#define WLC_MAX_2G_CHANNEL		CH_MAX_2G_CHANNEL
-#define	MAXCHANNEL		224
-
-#define WL_CHANSPEC_CHAN_MASK		0x00ff
-#define WL_CHANSPEC_CHAN_SHIFT		0
-
-#define WL_CHANSPEC_CTL_SB_MASK		0x0300
-#define WL_CHANSPEC_CTL_SB_SHIFT	     8
-#define WL_CHANSPEC_CTL_SB_LOWER	0x0100
-#define WL_CHANSPEC_CTL_SB_UPPER	0x0200
-#define WL_CHANSPEC_CTL_SB_NONE		0x0300
-
-#define WL_CHANSPEC_BW_MASK		0x0C00
-#define WL_CHANSPEC_BW_SHIFT		    10
-#define WL_CHANSPEC_BW_10		0x0400
-#define WL_CHANSPEC_BW_20		0x0800
-#define WL_CHANSPEC_BW_40		0x0C00
-
-#define WL_CHANSPEC_BAND_MASK		0xf000
-#define WL_CHANSPEC_BAND_SHIFT		12
-#define WL_CHANSPEC_BAND_5G		0x1000
-#define WL_CHANSPEC_BAND_2G		0x2000
-#define INVCHANSPEC			255
-
-
-#define WF_CHAN_FACTOR_2_4_G		4814
-#define WF_CHAN_FACTOR_5_G		10000
-#define WF_CHAN_FACTOR_4_G		8000
-
-
-#define LOWER_20_SB(channel)	(((channel) > CH_10MHZ_APART) ? ((channel) - CH_10MHZ_APART) : 0)
-#define UPPER_20_SB(channel)	(((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
-				((channel) + CH_10MHZ_APART) : 0)
-#define CHSPEC_WLCBANDUNIT(chspec)	(CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
-#define CH20MHZ_CHSPEC(channel)	(chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
-				WL_CHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
-				WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
-#define NEXT_20MHZ_CHAN(channel)	(((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
-					((channel) + CH_20MHZ_APART) : 0)
-#define CH40MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
-					((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
-					((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \
-					WL_CHANSPEC_BAND_5G))
-#define CHSPEC_CHANNEL(chspec)	((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
-#define CHSPEC_BAND(chspec)	((chspec) & WL_CHANSPEC_BAND_MASK)
-
-
-#define CHSPEC_CTL_SB(chspec)  (chspec & WL_CHANSPEC_CTL_SB_MASK)
-#define CHSPEC_BW(chspec)      (chspec & WL_CHANSPEC_BW_MASK)
-
-#ifdef WL11N_20MHZONLY
-
-#define CHSPEC_IS10(chspec)	0
-#define CHSPEC_IS20(chspec)	1
-#ifndef CHSPEC_IS40
-#define CHSPEC_IS40(chspec)	0
-#endif
-
-#else
-
-#define CHSPEC_IS10(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
-#define CHSPEC_IS20(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
-#ifndef CHSPEC_IS40
-#define CHSPEC_IS40(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
-#endif
-
-#endif
-
-#define CHSPEC_IS20_UNCOND(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
-
-#define CHSPEC_IS5G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
-#define CHSPEC_IS2G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
-#define CHSPEC_SB_NONE(chspec)	(((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_NONE)
-#define CHSPEC_SB_UPPER(chspec)	(((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER)
-#define CHSPEC_SB_LOWER(chspec)	(((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER)
-#define CHSPEC_CTL_CHAN(chspec)  ((CHSPEC_SB_LOWER(chspec)) ? \
-				  (LOWER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))) : \
-				  (UPPER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))))
-#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
-
-#define CHANSPEC_STR_LEN    8
-
-
-#define WLC_MAXRATE	108
-#define WLC_RATE_1M	2
-#define WLC_RATE_2M	4
-#define WLC_RATE_5M5	11
-#define WLC_RATE_11M	22
-#define WLC_RATE_6M	12
-#define WLC_RATE_9M	18
-#define WLC_RATE_12M	24
-#define WLC_RATE_18M	36
-#define WLC_RATE_24M	48
-#define WLC_RATE_36M	72
-#define WLC_RATE_48M	96
-#define WLC_RATE_54M	108
-
-#define WLC_2G_25MHZ_OFFSET		5
-
-
-extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
-
-
-extern chanspec_t wf_chspec_aton(char *a);
-
-
-extern bool wf_chspec_malformed(chanspec_t chanspec);
-
-
-extern uint8 wf_chspec_ctlchan(chanspec_t chspec);
-
-
-extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec);
-
-
-extern int wf_mhz2channel(uint freq, uint start_factor);
-
-
-extern int wf_channel2mhz(uint channel, uint start_factor);
-
-#endif
diff --git a/bcmdhd/dhdutil/include/bcmwifi_channels.h b/bcmdhd/dhdutil/include/bcmwifi_channels.h
index 3e46584..b2775b8 100644
--- a/bcmdhd/dhdutil/include/bcmwifi_channels.h
+++ b/bcmdhd/dhdutil/include/bcmwifi_channels.h
@@ -3,7 +3,7 @@
  * This header file housing the define and function prototype use by
  * both the wl driver, tools & Apps.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -24,10 +24,10 @@
 #define	_bcmwifi_channels_h_
 
 
-
+/* A chanspec holds the channel number, band, bandwidth and control sideband */
 typedef uint16 chanspec_t;
 
-
+/* channel defines */
 #define CH_UPPER_SB			0x01
 #define CH_LOWER_SB			0x02
 #define CH_EWA_VALID			0x04
@@ -35,12 +35,16 @@ typedef uint16 chanspec_t;
 #define CH_40MHZ_APART			8
 #define CH_20MHZ_APART			4
 #define CH_10MHZ_APART			2
-#define CH_5MHZ_APART			1	
-#define CH_MAX_2G_CHANNEL		14	
-#define	MAXCHANNEL		224	
-#define CHSPEC_CTLOVLP(sp1, sp2, sep)	ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < (sep)
-
-
+#define CH_5MHZ_APART			1	/* 2G band channels are 5 Mhz apart */
+#define CH_MAX_2G_CHANNEL		14	/* Max channel in 2G band */
+#define	MAXCHANNEL		224	/* max # supported channels. The max channel no is 216,
+					 * this is that + 1 rounded up to a multiple of NBBY (8).
+					 * DO NOT MAKE it > 255: channels are uint8's all over
+					 */
+#define CHSPEC_CTLOVLP(sp1, sp2, sep)	(ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < \
+				  (sep))
+
+/* All builds use the new 11ac ratespec/chanspec */
 #undef  D11AC_IOTYPES
 #define D11AC_IOTYPES
 
@@ -63,14 +67,27 @@ typedef uint16 chanspec_t;
 
 #define WL_CHANSPEC_BAND_MASK		0xf000
 #define WL_CHANSPEC_BAND_SHIFT		12
+#ifdef WL_CHANSPEC_BAND_5G
+#undef WL_CHANSPEC_BAND_5G
+#endif
+#ifdef WL_CHANSPEC_BAND_2G
+#undef WL_CHANSPEC_BAND_2G
+#endif
 #define WL_CHANSPEC_BAND_5G		0x1000
 #define WL_CHANSPEC_BAND_2G		0x2000
 #define INVCHANSPEC			255
 
-
+/* channel defines */
 #define LOWER_20_SB(channel)	(((channel) > CH_10MHZ_APART) ? ((channel) - CH_10MHZ_APART) : 0)
 #define UPPER_20_SB(channel)	(((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
 				((channel) + CH_10MHZ_APART) : 0)
+
+#define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0)
+#define UU_20_SB(channel) 	(((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \
+				((channel) + 3 * CH_10MHZ_APART) : 0)
+#define LU_20_SB(channel) LOWER_20_SB(channel)
+#define UL_20_SB(channel) UPPER_20_SB(channel)
+
 #define CHSPEC_WLCBANDUNIT(chspec)	(CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
 #define CH20MHZ_CHSPEC(channel)	(chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
 				WL_CHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
@@ -84,7 +101,7 @@ typedef uint16 chanspec_t;
 #define CHSPEC_CHANNEL(chspec)	((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
 #define CHSPEC_BAND(chspec)	((chspec) & WL_CHANSPEC_BAND_MASK)
 
-
+/* chanspec stores radio channel & flags to indicate control channel location, i.e. upper/lower */
 #define CHSPEC_CTL_SB(chspec)	((chspec) & WL_CHANSPEC_CTL_SB_MASK)
 #define CHSPEC_BW(chspec)	((chspec) & WL_CHANSPEC_BW_MASK)
 
@@ -96,7 +113,7 @@ typedef uint16 chanspec_t;
 #define CHSPEC_IS40(chspec)	0
 #endif
 
-#else 
+#else /* !WL11N_20MHZONLY */
 
 #define CHSPEC_IS10(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
 #define CHSPEC_IS20(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
@@ -104,7 +121,7 @@ typedef uint16 chanspec_t;
 #define CHSPEC_IS40(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
 #endif
 
-#endif 
+#endif /* !WL11N_20MHZONLY */
 
 #define CHSPEC_IS5G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
 #define CHSPEC_IS2G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
@@ -118,7 +135,7 @@ typedef uint16 chanspec_t;
 
 #define CHANSPEC_STR_LEN    8
 
-#else 
+#else /* D11AC_IOTYPES */
 
 #define WL_CHANSPEC_CHAN_MASK		0x00ff
 #define WL_CHANSPEC_CHAN_SHIFT		0
@@ -164,11 +181,18 @@ typedef uint16 chanspec_t;
 #define WL_CHANSPEC_BAND_5G		0xc000
 #define INVCHANSPEC			255
 
-
+/* channel defines */
 #define LOWER_20_SB(channel)		(((channel) > CH_10MHZ_APART) ? \
 					((channel) - CH_10MHZ_APART) : 0)
 #define UPPER_20_SB(channel)		(((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
 					((channel) + CH_10MHZ_APART) : 0)
+
+#define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0)
+#define UU_20_SB(channel) 	(((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \
+				((channel) + 3 * CH_10MHZ_APART) : 0)
+#define LU_20_SB(channel) LOWER_20_SB(channel)
+#define UL_20_SB(channel) UPPER_20_SB(channel)
+
 #define LOWER_40_SB(channel)		((channel) - CH_20MHZ_APART)
 #define UPPER_40_SB(channel)		((channel) + CH_20MHZ_APART)
 #define CHSPEC_WLCBANDUNIT(chspec)	(CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
@@ -188,7 +212,7 @@ typedef uint16 chanspec_t;
 					((channel) | (ctlsb) | \
 					 WL_CHANSPEC_BW_160 | WL_CHANSPEC_BAND_5G)
 
-
+/* simple MACROs to get different fields of chanspec */
 #define CHSPEC_CHANNEL(chspec)		((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
 #define CHSPEC_CHAN1(chspec)		((chspec) & WL_CHANSPEC_CHAN1_MASK)
 #define CHSPEC_CHAN2(chspec)		((chspec) & WL_CHANSPEC_CHAN2_MASK)
@@ -213,7 +237,7 @@ typedef uint16 chanspec_t;
 #define CHSPEC_IS8080(chspec)	0
 #endif
 
-#else 
+#else /* !WL11N_20MHZONLY */
 
 #define CHSPEC_IS10(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
 #define CHSPEC_IS20(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
@@ -230,7 +254,7 @@ typedef uint16 chanspec_t;
 #define CHSPEC_IS8080(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_8080)
 #endif
 
-#endif 
+#endif /* !WL11N_20MHZONLY */
 
 #define CHSPEC_IS5G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
 #define CHSPEC_IS2G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
@@ -242,11 +266,15 @@ typedef uint16 chanspec_t;
 	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
 #define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
 
-
+/**
+ * Number of chars needed for wf_chspec_ntoa() destination character buffer.
+ */
 #define CHANSPEC_STR_LEN    20
 
 
-
+/* Legacy Chanspec defines
+ * These are the defines for the previous format of the chanspec_t
+ */
 #define WL_LCHANSPEC_CHAN_MASK		0x00ff
 #define WL_LCHANSPEC_CHAN_SHIFT		     0
 
@@ -279,61 +307,182 @@ typedef uint16 chanspec_t;
 
 #define LCHSPEC_CREATE(chan, band, bw, sb)  ((uint16)((chan) | (sb) | (bw) | (band)))
 
-#endif 
-
-
-
+#endif /* D11AC_IOTYPES */
 
-#define WF_CHAN_FACTOR_2_4_G		4814	
-
-
-#define WF_CHAN_FACTOR_5_G		10000	
-
-
-#define WF_CHAN_FACTOR_4_G		8000	
+/*
+ * WF_CHAN_FACTOR_* constants are used to calculate channel frequency
+ * given a channel number.
+ * chan_freq = chan_factor * 500Mhz + chan_number * 5
+ */
 
+/**
+ * Channel Factor for the starting frequence of 2.4 GHz channels.
+ * The value corresponds to 2407 MHz.
+ */
+#define WF_CHAN_FACTOR_2_4_G		4814	/* 2.4 GHz band, 2407 MHz */
 
-#define WLC_MAXRATE	108	
-#define WLC_RATE_1M	2	
-#define WLC_RATE_2M	4	
-#define WLC_RATE_5M5	11	
-#define WLC_RATE_11M	22	
-#define WLC_RATE_6M	12	
-#define WLC_RATE_9M	18	
-#define WLC_RATE_12M	24	
-#define WLC_RATE_18M	36	
-#define WLC_RATE_24M	48	
-#define WLC_RATE_36M	72	
-#define WLC_RATE_48M	96	
-#define WLC_RATE_54M	108	
+/**
+ * Channel Factor for the starting frequence of 5 GHz channels.
+ * The value corresponds to 5000 MHz.
+ */
+#define WF_CHAN_FACTOR_5_G		10000	/* 5   GHz band, 5000 MHz */
 
-#define WLC_2G_25MHZ_OFFSET		5	
+/**
+ * Channel Factor for the starting frequence of 4.9 GHz channels.
+ * The value corresponds to 4000 MHz.
+ */
+#define WF_CHAN_FACTOR_4_G		8000	/* 4.9 GHz band for Japan */
 
+#define WLC_2G_25MHZ_OFFSET		5	/* 2.4GHz band channel offset */
 
+/**
+ * Convert chanspec to ascii string
+ *
+ * @param	chspec		chanspec format
+ * @param	buf		ascii string of chanspec
+ *
+ * @return	pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *
+ * @see		CHANSPEC_STR_LEN
+ */
 extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
 
-
+/**
+ * Convert ascii string to chanspec
+ *
+ * @param	a     pointer to input string
+ *
+ * @return	>= 0 if successful or 0 otherwise
+ */
 extern chanspec_t wf_chspec_aton(const char *a);
 
-
+/**
+ * Verify the chanspec fields are valid.
+ *
+ * Verify the chanspec is using a legal set field values, i.e. that the chanspec
+ * specified a band, bw, ctl_sb and channel and that the combination could be
+ * legal given some set of circumstances.
+ *
+ * @param	chanspec   input chanspec to verify
+ *
+ * @return TRUE if the chanspec is malformed, FALSE if it looks good.
+ */
 extern bool wf_chspec_malformed(chanspec_t chanspec);
 
-
+/**
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ *
+ * @param	chanspec   input chanspec to verify
+ *
+ * @return TRUE if the chanspec is a valid 802.11 channel
+ */
 extern bool wf_chspec_valid(chanspec_t chanspec);
 
-
+/**
+ * Return the primary (control) channel.
+ *
+ * This function returns the channel number of the primary 20MHz channel. For
+ * 20MHz channels this is just the channel number. For 40MHz or wider channels
+ * it is the primary 20MHz channel specified by the chanspec.
+ *
+ * @param	chspec    input chanspec
+ *
+ * @return Returns the channel number of the primary 20MHz channel
+ */
 extern uint8 wf_chspec_ctlchan(chanspec_t chspec);
 
-
+/**
+ * Return the primary (control) chanspec.
+ *
+ * This function returns the chanspec of the primary 20MHz channel. For 20MHz
+ * channels this is just the chanspec. For 40MHz or wider channels it is the
+ * chanspec of the primary 20MHZ channel specified by the chanspec.
+ *
+ * @param	chspec    input chanspec
+ *
+ * @return Returns the chanspec of the primary 20MHz channel
+ */
 extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec);
 
-
+/**
+ * Return a channel number corresponding to a frequency.
+ *
+ * This function returns the chanspec for the primary 40MHz of an 80MHz channel.
+ * The control sideband specifies the same 20MHz channel that the 80MHz channel is using
+ * as the primary 20MHz channel.
+ */
 extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec);
 
-
+/*
+ * Return the channel number for a given frequency and base frequency.
+ * The returned channel number is relative to the given base frequency.
+ * If the given base frequency is zero, a base frequency of 5 GHz is assumed for
+ * frequencies from 5 - 6 GHz, and 2.407 GHz is assumed for 2.4 - 2.5 GHz.
+ *
+ * Frequency is specified in MHz.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ *
+ * The returned channel will be in the range [1, 14] in the 2.4 GHz band
+ * and [0, 200] otherwise.
+ * -1 is returned if the start_factor is WF_CHAN_FACTOR_2_4_G and the
+ * frequency is not a 2.4 GHz channel, or if the frequency is not and even
+ * multiple of 5 MHz from the base frequency to the base plus 1 GHz.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ *
+ * @param	freq          frequency in MHz
+ * @param	start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a channel number
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ */
 extern int wf_mhz2channel(uint freq, uint start_factor);
 
-
+/**
+ * Return the center frequency in MHz of the given channel and base frequency.
+ *
+ * Return the center frequency in MHz of the given channel and base frequency.
+ * The channel number is interpreted relative to the given base frequency.
+ *
+ * The valid channel range is [1, 14] in the 2.4 GHz band and [0, 200] otherwise.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ * The channel range of [1, 14] is only checked for a start_factor of
+ * WF_CHAN_FACTOR_2_4_G (4814).
+ * Odd start_factors produce channels on .5 MHz boundaries, in which case
+ * the answer is rounded down to an integral MHz.
+ * -1 is returned for an out of range channel.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ *
+ * @param	channel       input channel number
+ * @param	start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a frequency in MHz
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ */
 extern int wf_channel2mhz(uint channel, uint start_factor);
 
-#endif	
+/**
+ * Convert ctl chan and bw to chanspec
+ *
+ * @param	ctl_ch		channel
+ * @param	bw	        bandwidth
+ *
+ * @return	> 0 if successful or 0 otherwise
+ *
+ */
+extern uint16 wf_channel2chspec(uint ctl_ch, uint bw);
+
+extern uint wf_channel2freq(uint channel);
+extern uint wf_freq2channel(uint freq);
+
+
+#endif	/* _bcmwifi_channels_h_ */
diff --git a/bcmdhd/dhdutil/include/bcmwifi_rates.h b/bcmdhd/dhdutil/include/bcmwifi_rates.h
index 68acfca..4b6399e 100644
--- a/bcmdhd/dhdutil/include/bcmwifi_rates.h
+++ b/bcmdhd/dhdutil/include/bcmwifi_rates.h
@@ -1,7 +1,7 @@
 /*
  * Indices for 802.11 a/b/g/n/ac 1-3 chain symmetric transmit rates
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmwifi_rates.h 252708 2011-04-12 06:45:56Z $
+ * $Id: bcmwifi_rates.h 5187 2012-06-29 06:17:50Z $
  */
 
 #ifndef _bcmwifi_rates_h_
@@ -23,7 +23,7 @@
 
 #ifdef __cplusplus
 extern "C" {
-#endif 
+#endif /* __cplusplus */
 
 
 #define WL_RATESET_SZ_DSSS		4
@@ -33,30 +33,33 @@ extern "C" {
 
 #define WL_TX_CHAINS_MAX	3
 
-#define WL_RATE_DISABLED		(-128) 
-
+#define WL_RATE_DISABLED		(-128) /* Power value corresponding to unsupported rate */
 
+/* Transmit channel bandwidths */
 typedef enum wl_tx_bw {
 	WL_TX_BW_20,
 	WL_TX_BW_40,
 	WL_TX_BW_80,
 	WL_TX_BW_20IN40,
 	WL_TX_BW_20IN80,
-	WL_TX_BW_40IN80,
-	WL_TX_BW_ALL
+	WL_TX_BW_40IN80
 } wl_tx_bw_t;
 
 
-
+/*
+ * Transmit modes.
+ * Not all modes are listed here, only those required for disambiguation. e.g. SPEXP is not listed
+ */
 typedef enum wl_tx_mode {
 	WL_TX_MODE_NONE,
 	WL_TX_MODE_STBC,
 	WL_TX_MODE_CDD,
-	WL_TX_MODE_SDM
+	WL_TX_MODE_TXBF,
+	WL_NUM_TX_MODES
 } wl_tx_mode_t;
 
 
-
+/* Number of transmit chains */
 typedef enum wl_tx_chains {
 	WL_TX_CHAINS_1 = 1,
 	WL_TX_CHAINS_2,
@@ -64,7 +67,7 @@ typedef enum wl_tx_chains {
 } wl_tx_chains_t;
 
 
-
+/* Number of transmit streams */
 typedef enum wl_tx_nss {
 	WL_TX_NSS_1 = 1,
 	WL_TX_NSS_2,
@@ -73,9 +76,12 @@ typedef enum wl_tx_nss {
 
 
 typedef enum clm_rates {
-	
+	/************
+	* 1 chain  *
+	************
+	*/
 
-	
+	/* 1 Stream */
 	WL_RATE_1X1_DSSS_1         = 0,
 	WL_RATE_1X1_DSSS_2         = 1,
 	WL_RATE_1X1_DSSS_5_5       = 2,
@@ -111,9 +117,12 @@ typedef enum clm_rates {
 	WL_RATE_1X1_VHT9SS1        = 21,
 
 
-	
+	/************
+	* 2 chains *
+	************
+	*/
 
-	
+	/* 1 Stream expanded + 1 */
 	WL_RATE_1X2_DSSS_1         = 22,
 	WL_RATE_1X2_DSSS_2         = 23,
 	WL_RATE_1X2_DSSS_5_5       = 24,
@@ -148,7 +157,7 @@ typedef enum clm_rates {
 	WL_RATE_1X2_VHT8SS1        = 42,
 	WL_RATE_1X2_VHT9SS1        = 43,
 
-	
+	/* 2 Streams */
 	WL_RATE_2X2_STBC_MCS0      = 44,
 	WL_RATE_2X2_STBC_MCS1      = 45,
 	WL_RATE_2X2_STBC_MCS2      = 46,
@@ -189,10 +198,12 @@ typedef enum clm_rates {
 	WL_RATE_2X2_VHT8SS2        = 62,
 	WL_RATE_2X2_VHT9SS2        = 63,
 
+	/************
+	* 3 chains *
+	************
+	*/
 
-	
-
-	
+	/* 1 Stream expanded + 2 */
 	WL_RATE_1X3_DSSS_1         = 64,
 	WL_RATE_1X3_DSSS_2         = 65,
 	WL_RATE_1X3_DSSS_5_5       = 66,
@@ -227,7 +238,7 @@ typedef enum clm_rates {
 	WL_RATE_1X3_VHT8SS1        = 84,
 	WL_RATE_1X3_VHT9SS1        = 85,
 
-	
+	/* 2 Streams expanded + 1 */
 	WL_RATE_2X3_STBC_MCS0      = 86,
 	WL_RATE_2X3_STBC_MCS1      = 87,
 	WL_RATE_2X3_STBC_MCS2      = 88,
@@ -268,7 +279,7 @@ typedef enum clm_rates {
 	WL_RATE_2X3_VHT8SS2        = 104,
 	WL_RATE_2X3_VHT9SS2        = 105,
 
-	
+	/* 3 Streams */
 	WL_RATE_3X3_SDM_MCS16      = 106,
 	WL_RATE_3X3_SDM_MCS17      = 107,
 	WL_RATE_3X3_SDM_MCS18      = 108,
@@ -289,12 +300,148 @@ typedef enum clm_rates {
 	WL_RATE_3X3_VHT8SS3        = 114,
 	WL_RATE_3X3_VHT9SS3        = 115,
 
-	
-	WL_NUMRATES                = 116
+
+	/****************************
+	 * TX Beamforming, 2 chains *
+	 ****************************
+	 */
+
+	/* 1 Stream expanded + 1 */
+
+	WL_RATE_1X2_TXBF_OFDM_6    = 116,
+	WL_RATE_1X2_TXBF_OFDM_9    = 117,
+	WL_RATE_1X2_TXBF_OFDM_12   = 118,
+	WL_RATE_1X2_TXBF_OFDM_18   = 119,
+	WL_RATE_1X2_TXBF_OFDM_24   = 120,
+	WL_RATE_1X2_TXBF_OFDM_36   = 121,
+	WL_RATE_1X2_TXBF_OFDM_48   = 122,
+	WL_RATE_1X2_TXBF_OFDM_54   = 123,
+
+	WL_RATE_1X2_TXBF_MCS0      = 124,
+	WL_RATE_1X2_TXBF_MCS1      = 125,
+	WL_RATE_1X2_TXBF_MCS2      = 126,
+	WL_RATE_1X2_TXBF_MCS3      = 127,
+	WL_RATE_1X2_TXBF_MCS4      = 128,
+	WL_RATE_1X2_TXBF_MCS5      = 129,
+	WL_RATE_1X2_TXBF_MCS6      = 130,
+	WL_RATE_1X2_TXBF_MCS7      = 131,
+
+	WL_RATE_1X2_TXBF_VHT0SS1   = 124,
+	WL_RATE_1X2_TXBF_VHT1SS1   = 125,
+	WL_RATE_1X2_TXBF_VHT2SS1   = 126,
+	WL_RATE_1X2_TXBF_VHT3SS1   = 127,
+	WL_RATE_1X2_TXBF_VHT4SS1   = 128,
+	WL_RATE_1X2_TXBF_VHT5SS1   = 129,
+	WL_RATE_1X2_TXBF_VHT6SS1   = 130,
+	WL_RATE_1X2_TXBF_VHT7SS1   = 131,
+	WL_RATE_1X2_TXBF_VHT8SS1   = 132,
+	WL_RATE_1X2_TXBF_VHT9SS1   = 133,
+
+	/* 2 Streams */
+
+	WL_RATE_2X2_TXBF_SDM_MCS8  = 134,
+	WL_RATE_2X2_TXBF_SDM_MCS9  = 135,
+	WL_RATE_2X2_TXBF_SDM_MCS10 = 136,
+	WL_RATE_2X2_TXBF_SDM_MCS11 = 137,
+	WL_RATE_2X2_TXBF_SDM_MCS12 = 138,
+	WL_RATE_2X2_TXBF_SDM_MCS13 = 139,
+	WL_RATE_2X2_TXBF_SDM_MCS14 = 140,
+	WL_RATE_2X2_TXBF_SDM_MCS15 = 141,
+
+	WL_RATE_2X2_TXBF_VHT0SS2   = 134,
+	WL_RATE_2X2_TXBF_VHT1SS2   = 135,
+	WL_RATE_2X2_TXBF_VHT2SS2   = 136,
+	WL_RATE_2X2_TXBF_VHT3SS2   = 137,
+	WL_RATE_2X2_TXBF_VHT4SS2   = 138,
+	WL_RATE_2X2_TXBF_VHT5SS2   = 139,
+	WL_RATE_2X2_TXBF_VHT6SS2   = 140,
+	WL_RATE_2X2_TXBF_VHT7SS2   = 141,
+
+
+	/****************************
+	 * TX Beamforming, 3 chains *
+	 ****************************
+	 */
+
+	/* 1 Stream expanded + 2 */
+
+	WL_RATE_1X3_TXBF_OFDM_6    = 142,
+	WL_RATE_1X3_TXBF_OFDM_9    = 143,
+	WL_RATE_1X3_TXBF_OFDM_12   = 144,
+	WL_RATE_1X3_TXBF_OFDM_18   = 145,
+	WL_RATE_1X3_TXBF_OFDM_24   = 146,
+	WL_RATE_1X3_TXBF_OFDM_36   = 147,
+	WL_RATE_1X3_TXBF_OFDM_48   = 148,
+	WL_RATE_1X3_TXBF_OFDM_54   = 149,
+
+	WL_RATE_1X3_TXBF_MCS0      = 150,
+	WL_RATE_1X3_TXBF_MCS1      = 151,
+	WL_RATE_1X3_TXBF_MCS2      = 152,
+	WL_RATE_1X3_TXBF_MCS3      = 153,
+	WL_RATE_1X3_TXBF_MCS4      = 154,
+	WL_RATE_1X3_TXBF_MCS5      = 155,
+	WL_RATE_1X3_TXBF_MCS6      = 156,
+	WL_RATE_1X3_TXBF_MCS7      = 157,
+
+	WL_RATE_1X3_TXBF_VHT0SS1   = 150,
+	WL_RATE_1X3_TXBF_VHT1SS1   = 151,
+	WL_RATE_1X3_TXBF_VHT2SS1   = 152,
+	WL_RATE_1X3_TXBF_VHT3SS1   = 153,
+	WL_RATE_1X3_TXBF_VHT4SS1   = 154,
+	WL_RATE_1X3_TXBF_VHT5SS1   = 155,
+	WL_RATE_1X3_TXBF_VHT6SS1   = 156,
+	WL_RATE_1X3_TXBF_VHT7SS1   = 157,
+	WL_RATE_1X3_TXBF_VHT8SS1   = 158,
+	WL_RATE_1X3_TXBF_VHT9SS1   = 159,
+
+	/* 2 Streams expanded + 1 */
+
+	WL_RATE_2X3_TXBF_SDM_MCS8  = 160,
+	WL_RATE_2X3_TXBF_SDM_MCS9  = 161,
+	WL_RATE_2X3_TXBF_SDM_MCS10 = 162,
+	WL_RATE_2X3_TXBF_SDM_MCS11 = 163,
+	WL_RATE_2X3_TXBF_SDM_MCS12 = 164,
+	WL_RATE_2X3_TXBF_SDM_MCS13 = 165,
+	WL_RATE_2X3_TXBF_SDM_MCS14 = 166,
+	WL_RATE_2X3_TXBF_SDM_MCS15 = 167,
+
+	WL_RATE_2X3_TXBF_VHT0SS2   = 160,
+	WL_RATE_2X3_TXBF_VHT1SS2   = 161,
+	WL_RATE_2X3_TXBF_VHT2SS2   = 162,
+	WL_RATE_2X3_TXBF_VHT3SS2   = 163,
+	WL_RATE_2X3_TXBF_VHT4SS2   = 164,
+	WL_RATE_2X3_TXBF_VHT5SS2   = 165,
+	WL_RATE_2X3_TXBF_VHT6SS2   = 166,
+	WL_RATE_2X3_TXBF_VHT7SS2   = 167,
+	WL_RATE_2X3_TXBF_VHT8SS2   = 168,
+	WL_RATE_2X3_TXBF_VHT9SS2   = 169,
+
+	/* 3 Streams */
+
+	WL_RATE_3X3_TXBF_SDM_MCS16 = 170,
+	WL_RATE_3X3_TXBF_SDM_MCS17 = 171,
+	WL_RATE_3X3_TXBF_SDM_MCS18 = 172,
+	WL_RATE_3X3_TXBF_SDM_MCS19 = 173,
+	WL_RATE_3X3_TXBF_SDM_MCS20 = 174,
+	WL_RATE_3X3_TXBF_SDM_MCS21 = 175,
+	WL_RATE_3X3_TXBF_SDM_MCS22 = 176,
+	WL_RATE_3X3_TXBF_SDM_MCS23 = 177,
+
+	WL_RATE_3X3_TXBF_VHT0SS3   = 170,
+	WL_RATE_3X3_TXBF_VHT1SS3   = 171,
+	WL_RATE_3X3_TXBF_VHT2SS3   = 172,
+	WL_RATE_3X3_TXBF_VHT3SS3   = 173,
+	WL_RATE_3X3_TXBF_VHT4SS3   = 174,
+	WL_RATE_3X3_TXBF_VHT5SS3   = 175,
+	WL_RATE_3X3_TXBF_VHT6SS3   = 176,
+	WL_RATE_3X3_TXBF_VHT7SS3   = 177
 } clm_rates_t;
 
+/* Number of rate codes */
+#define WL_NUMRATES 178
+
 #ifdef __cplusplus
 }
-#endif 
+#endif /* __cplusplus */
 
-#endif 
+#endif /* _bcmwifi_rates_h_ */
diff --git a/bcmdhd/dhdutil/include/dhdioctl.h b/bcmdhd/dhdutil/include/dhdioctl.h
index 25e0028..d9f6076 100644
--- a/bcmdhd/dhdutil/include/dhdioctl.h
+++ b/bcmdhd/dhdutil/include/dhdioctl.h
@@ -5,7 +5,7 @@
  *
  * Definitions subject to change without notice.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -19,7 +19,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdioctl.h 350488 2012-08-14 04:36:26Z $
+ * $Id: dhdioctl.h 390859 2013-03-14 01:09:31Z $
  */
 
 #ifndef _dhdioctl_h_
@@ -83,7 +83,8 @@ enum {
 #define DHD_ARPOE_VAL	0x4000
 #define DHD_REORDER_VAL	0x8000
 #define DHD_WL_VAL		0x10000
-#define DHD_TRACE2_VAL	0x20000
+#define DHD_NOCHECKDIED_VAL		0x20000 /* UTF WAR */
+#define DHD_WL_VAL2		0x40000
 
 #ifdef SDTEST
 /* For pktgen iovar */
diff --git a/bcmdhd/dhdutil/include/epivers.h b/bcmdhd/dhdutil/include/epivers.h
index cec06b4..de34916 100644
--- a/bcmdhd/dhdutil/include/epivers.h
+++ b/bcmdhd/dhdutil/include/epivers.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -13,7 +13,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: epivers.h.in,v 13.33 2010-09-08 22:08:53 $
+ * $Id: epivers.h.in,v 13.33 2010-09-08 22:08:53 csm Exp $
  *
 */
 
@@ -22,21 +22,19 @@
 
 #define	EPI_MAJOR_VERSION	1
 
-#define	EPI_MINOR_VERSION	28
+#define	EPI_MINOR_VERSION	88
 
-#define	EPI_RC_NUMBER		9
+#define	EPI_RC_NUMBER		5
 
-#define	EPI_INCREMENTAL_NUMBER	2
+#define	EPI_INCREMENTAL_NUMBER	0
 
 #define	EPI_BUILD_NUMBER	0
 
-#define	EPI_VERSION		1, 28, 9, 2
-
-#define	EPI_VERSION_NUM		0x011c0902
-
-#define EPI_VERSION_DEV		1.28.9
+#define	EPI_VERSION		1, 88, 5, 0
 
+#define	EPI_VERSION_NUM		0x01580500
 
-#define	EPI_VERSION_STR		"1.28.9.2 (r351283)"
+#define EPI_VERSION_DEV		1.88.5
+#define	EPI_VERSION_STR		"1.88.5 (r)"
 
-#endif
+#endif /* _epivers_h_ */
diff --git a/bcmdhd/dhdutil/include/hndrte_armtrap.h b/bcmdhd/dhdutil/include/hndrte_armtrap.h
new file mode 100644
index 0000000..8efcf07
--- /dev/null
+++ b/bcmdhd/dhdutil/include/hndrte_armtrap.h
@@ -0,0 +1,82 @@
+/*
+ * HNDRTE arm trap handling.
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: hndrte_armtrap.h 261365 2011-05-24 20:42:23Z $
+ */
+
+#ifndef	_hndrte_armtrap_h
+#define	_hndrte_armtrap_h
+
+
+/* ARM trap handling */
+
+/* Trap types defined by ARM (see arminc.h) */
+
+/* Trap locations in lo memory */
+#define	TRAP_STRIDE	4
+#define FIRST_TRAP	TR_RST
+#define LAST_TRAP	(TR_FIQ * TRAP_STRIDE)
+
+#if defined(__ARM_ARCH_4T__)
+#define	MAX_TRAP_TYPE	(TR_FIQ + 1)
+#elif defined(__ARM_ARCH_7M__)
+#define	MAX_TRAP_TYPE	(TR_ISR + ARMCM3_NUMINTS)
+#endif	/* __ARM_ARCH_7M__ */
+
+/* The trap structure is defined here as offsets for assembly */
+#define	TR_TYPE		0x00
+#define	TR_EPC		0x04
+#define	TR_CPSR		0x08
+#define	TR_SPSR		0x0c
+#define	TR_REGS		0x10
+#define	TR_REG(n)	(TR_REGS + (n) * 4)
+#define	TR_SP		TR_REG(13)
+#define	TR_LR		TR_REG(14)
+#define	TR_PC		TR_REG(15)
+
+#define	TRAP_T_SIZE	80
+
+#ifndef	_LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+typedef struct _trap_struct {
+	uint32		type;
+	uint32		epc;
+	uint32		cpsr;
+	uint32		spsr;
+	uint32		r0;	/* a1 */
+	uint32		r1;	/* a2 */
+	uint32		r2;	/* a3 */
+	uint32		r3;	/* a4 */
+	uint32		r4;	/* v1 */
+	uint32		r5;	/* v2 */
+	uint32		r6;	/* v3 */
+	uint32		r7;	/* v4 */
+	uint32		r8;	/* v5 */
+	uint32		r9;	/* sb/v6 */
+	uint32		r10;	/* sl/v7 */
+	uint32		r11;	/* fp/v8 */
+	uint32		r12;	/* ip */
+	uint32		r13;	/* sp */
+	uint32		r14;	/* lr */
+	uint32		pc;	/* r15 */
+} trap_t;
+
+#endif	/* !_LANGUAGE_ASSEMBLY */
+
+#endif	/* _hndrte_armtrap_h */
diff --git a/bcmdhd/dhdutil/include/hndrte_cons.h b/bcmdhd/dhdutil/include/hndrte_cons.h
new file mode 100644
index 0000000..b5d8db3
--- /dev/null
+++ b/bcmdhd/dhdutil/include/hndrte_cons.h
@@ -0,0 +1,63 @@
+/*
+ * Console support for hndrte.
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: hndrte_cons.h 383834 2013-02-07 23:21:51Z $
+ */
+#ifndef	_HNDRTE_CONS_H
+#define	_HNDRTE_CONS_H
+
+#include <typedefs.h>
+
+#define CBUF_LEN	(128)
+
+#define LOG_BUF_LEN	1024
+
+typedef struct {
+	uint32		buf;		/* Can't be pointer on (64-bit) hosts */
+	uint		buf_size;
+	uint		idx;
+	char		*_buf_compat;	/* redundant pointer for backward compat. */
+} hndrte_log_t;
+
+typedef struct {
+	/* Virtual UART
+	 *   When there is no UART (e.g. Quickturn), the host should write a complete
+	 *   input line directly into cbuf and then write the length into vcons_in.
+	 *   This may also be used when there is a real UART (at risk of conflicting with
+	 *   the real UART).  vcons_out is currently unused.
+	 */
+	volatile uint	vcons_in;
+	volatile uint	vcons_out;
+
+	/* Output (logging) buffer
+	 *   Console output is written to a ring buffer log_buf at index log_idx.
+	 *   The host may read the output when it sees log_idx advance.
+	 *   Output will be lost if the output wraps around faster than the host polls.
+	 */
+	hndrte_log_t	log;
+
+	/* Console input line buffer
+	 *   Characters are read one at a time into cbuf until <CR> is received, then
+	 *   the buffer is processed as a command line.  Also used for virtual UART.
+	 */
+	uint		cbuf_idx;
+	char		cbuf[CBUF_LEN];
+} hndrte_cons_t;
+
+hndrte_cons_t *hndrte_get_active_cons_state(void);
+
+#endif /* _HNDRTE_CONS_H */
diff --git a/bcmdhd/dhdutil/include/hndrte_debug.h b/bcmdhd/dhdutil/include/hndrte_debug.h
new file mode 100644
index 0000000..d3785ce
--- /dev/null
+++ b/bcmdhd/dhdutil/include/hndrte_debug.h
@@ -0,0 +1,108 @@
+/*
+ * HND Run Time Environment debug info area
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: hndrte_debug.h 342211 2012-07-02 02:23:04Z $
+ */
+
+#ifndef	_HNDRTE_DEBUG_H
+#define	_HNDRTE_DEBUG_H
+
+/* Magic number at a magic location to find HNDRTE_DEBUG pointers */
+#define HNDRTE_DEBUG_PTR_PTR_ADDR 0xf8
+#define HNDRTE_DEBUG_PTR_PTR_MAGIC 0x50504244  	/* DBPP */
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* Includes only when building dongle code */
+
+
+#define NUM_EVENT_LOG_SETS 4
+
+/* We use explicit sizes here since this gets included from different
+ * systems.  The sizes must be the size of the creating system
+ * (currently 32 bit ARM) since this is gleaned from  dump.
+ */
+
+/* Define pointers for use on other systems */
+#define _HD_EVLOG_P	uint32
+#define _HD_CONS_P	uint32
+#define _HD_TRAP_P	uint32
+
+typedef struct hndrte_debug {
+	uint32	magic;
+#define HNDRTE_DEBUG_MAGIC 0x47424544	/* 'DEBG' */
+
+	uint32	version;		/* Debug struct version */
+#define HNDRTE_DEBUG_VERSION 1
+
+	uint32	fwid;			/* 4 bytes of fw info */
+	char	epivers[32];
+
+	_HD_TRAP_P trap_ptr;		/* trap_t data struct */
+	_HD_CONS_P console;		/* Console  */
+
+	uint32	ram_base;
+	uint32	ram_size;
+
+	uint32	rom_base;
+	uint32	rom_size;
+
+	_HD_EVLOG_P event_log_top;
+
+} hndrte_debug_t;
+
+/*
+ * timeval_t and prstatus_t are copies of the Linux structures.
+ * Included here because we need the definitions for the target processor
+ * (32 bits) and not the definition on the host this is running on
+ * (which could be 64 bits).
+ */
+
+typedef struct             {    /* Time value with microsecond resolution    */
+	uint32 tv_sec;	/* Seconds                                   */
+	uint32 tv_usec;	/* Microseconds                              */
+} timeval_t;
+
+
+/* Linux/ARM 32 prstatus for notes section */
+typedef struct prstatus {
+	  int32 si_signo; 	/* Signal number */
+	  int32 si_code; 	/* Extra code */
+	  int32 si_errno; 	/* Errno */
+	  uint16 pr_cursig; 	/* Current signal.  */
+	  uint16 unused;
+	  uint32 pr_sigpend;	/* Set of pending signals.  */
+	  uint32 pr_sighold;	/* Set of held signals.  */
+	  uint32 pr_pid;
+	  uint32 pr_ppid;
+	  uint32 pr_pgrp;
+	  uint32 pr_sid;
+	  timeval_t pr_utime;	/* User time.  */
+	  timeval_t pr_stime;	/* System time.  */
+	  timeval_t pr_cutime;	/* Cumulative user time.  */
+	  timeval_t pr_cstime;	/* Cumulative system time.  */
+	  uint32 uregs[18];
+	  int32 pr_fpvalid;	/* True if math copro being used.  */
+} prstatus_t;
+
+#ifdef DUMP_INFO
+extern hndrte_debug_t hndrte_debug_info __attribute__ ((weak));
+#endif
+
+#endif /* LANGUAGE_ASSEMBLY */
+
+#endif /* _HNDRTE_DEBUG_H */
diff --git a/bcmdhd/dhdutil/include/miniopt.h b/bcmdhd/dhdutil/include/miniopt.h
index f3d9ce8..ed91eae 100644
--- a/bcmdhd/dhdutil/include/miniopt.h
+++ b/bcmdhd/dhdutil/include/miniopt.h
@@ -1,7 +1,7 @@
 /*
  * Command line options parser.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: miniopt.h,v 1.3 2009-01-15 00:06:54 Exp $
+ * $Id: miniopt.h 241182 2011-02-17 21:50:03Z $
  */
 
 
diff --git a/bcmdhd/dhdutil/include/packed_section_end.h b/bcmdhd/dhdutil/include/packed_section_end.h
index 5644a93..cbaff68 100644
--- a/bcmdhd/dhdutil/include/packed_section_end.h
+++ b/bcmdhd/dhdutil/include/packed_section_end.h
@@ -15,7 +15,7 @@
  * #include <packed_section_end.h>
  *
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -29,12 +29,14 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: packed_section_end.h,v 1.4 2008-12-09 23:43:22 Exp $
+ * $Id: packed_section_end.h 241182 2011-02-17 21:50:03Z $
  */
 
 
-
-
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is NOT defined at this
+ * point, then there is a missing include of packed_section_start.h.
+ */
 #ifdef BWL_PACKED_SECTION
 	#undef BWL_PACKED_SECTION
 #else
@@ -44,6 +46,9 @@
 
 
 
-
+/* Compiler-specific directives for structure packing are declared in
+ * packed_section_start.h. This marks the end of the structure packing section,
+ * so, undef them here.
+ */
 #undef	BWL_PRE_PACKED_STRUCT
 #undef	BWL_POST_PACKED_STRUCT
diff --git a/bcmdhd/dhdutil/include/packed_section_start.h b/bcmdhd/dhdutil/include/packed_section_start.h
index c6a7053..e005b7b 100644
--- a/bcmdhd/dhdutil/include/packed_section_start.h
+++ b/bcmdhd/dhdutil/include/packed_section_start.h
@@ -15,7 +15,7 @@
  * #include <packed_section_end.h>
  *
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -33,7 +33,10 @@
  */
 
 
-
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is already defined at this
+ * point, then there is a missing include of packed_section_end.h.
+ */
 #ifdef BWL_PACKED_SECTION
 	#error "BWL_PACKED_SECTION is already defined!"
 #else
@@ -43,7 +46,7 @@
 
 
 
-
+/* Declare compiler-specific directives for structure packing. */
 #if defined(__GNUC__) || defined(__lint)
 	#define	BWL_PRE_PACKED_STRUCT
 	#define	BWL_POST_PACKED_STRUCT	__attribute__ ((packed))
diff --git a/bcmdhd/dhdutil/include/proto/802.11.h b/bcmdhd/dhdutil/include/proto/802.11.h
index e55d1e1..b073369 100644
--- a/bcmdhd/dhdutil/include/proto/802.11.h
+++ b/bcmdhd/dhdutil/include/proto/802.11.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,10 +15,9 @@
  *
  * Fundamental types and constants relating to 802.11
  *
- * $Id: 802.11.h 346820 2012-07-24 13:53:12Z $
+ * $Id: 802.11.h 386067 2013-02-19 15:24:20Z $
  */
 
-
 #ifndef _802_11_H_
 #define _802_11_H_
 
@@ -32,255 +31,265 @@
 
 #include <proto/wpa.h>
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
 
-#define DOT11_TU_TO_US          1024
-
-
-#define DOT11_A3_HDR_LEN        24
-#define DOT11_A4_HDR_LEN        30
-#define DOT11_MAC_HDR_LEN       DOT11_A3_HDR_LEN
-#define DOT11_FCS_LEN           4
-#define DOT11_ICV_LEN           4
-#define DOT11_ICV_AES_LEN       8
-#define DOT11_QOS_LEN           2
-#define DOT11_HTC_LEN           4
-
-#define DOT11_KEY_INDEX_SHIFT       6
-#define DOT11_IV_LEN            4
-#define DOT11_IV_TKIP_LEN       8
-#define DOT11_IV_AES_OCB_LEN        4
-#define DOT11_IV_AES_CCM_LEN        8
-#define DOT11_IV_MAX_LEN        8
-
-
-#define DOT11_MAX_MPDU_BODY_LEN     2304
-
-#define DOT11_MAX_MPDU_LEN      (DOT11_A4_HDR_LEN + \
+#define DOT11_TU_TO_US			1024	/* 802.11 Time Unit is 1024 microseconds */
+
+/* Generic 802.11 frame constants */
+#define DOT11_A3_HDR_LEN		24	/* d11 header length with A3 */
+#define DOT11_A4_HDR_LEN		30	/* d11 header length with A4 */
+#define DOT11_MAC_HDR_LEN		DOT11_A3_HDR_LEN	/* MAC header length */
+#define DOT11_FCS_LEN			4	/* d11 FCS length */
+#define DOT11_ICV_LEN			4	/* d11 ICV length */
+#define DOT11_ICV_AES_LEN		8	/* d11 ICV/AES length */
+#define DOT11_QOS_LEN			2	/* d11 QoS length */
+#define DOT11_HTC_LEN			4	/* d11 HT Control field length */
+
+#define DOT11_KEY_INDEX_SHIFT		6	/* d11 key index shift */
+#define DOT11_IV_LEN			4	/* d11 IV length */
+#define DOT11_IV_TKIP_LEN		8	/* d11 IV TKIP length */
+#define DOT11_IV_AES_OCB_LEN		4	/* d11 IV/AES/OCB length */
+#define DOT11_IV_AES_CCM_LEN		8	/* d11 IV/AES/CCM length */
+#define DOT11_IV_MAX_LEN		8	/* maximum iv len for any encryption */
+
+/* Includes MIC */
+#define DOT11_MAX_MPDU_BODY_LEN		2304	/* max MPDU body length */
+/* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
+#define DOT11_MAX_MPDU_LEN		(DOT11_A4_HDR_LEN + \
 					 DOT11_QOS_LEN + \
 					 DOT11_IV_AES_CCM_LEN + \
 					 DOT11_MAX_MPDU_BODY_LEN + \
 					 DOT11_ICV_LEN + \
-					 DOT11_FCS_LEN)
-
-#define DOT11_MAX_SSID_LEN      32
-
-
-#define DOT11_DEFAULT_RTS_LEN       2347
-#define DOT11_MAX_RTS_LEN       2347
-
-
-#define DOT11_MIN_FRAG_LEN      256
-#define DOT11_MAX_FRAG_LEN      2346
-#define DOT11_DEFAULT_FRAG_LEN      2346
+					 DOT11_FCS_LEN)	/* d11 max MPDU length */
 
+#define DOT11_MAX_SSID_LEN		32	/* d11 max ssid length */
 
-#define DOT11_MIN_BEACON_PERIOD     1
-#define DOT11_MAX_BEACON_PERIOD     0xFFFF
+/* dot11RTSThreshold */
+#define DOT11_DEFAULT_RTS_LEN		2347	/* d11 default RTS length */
+#define DOT11_MAX_RTS_LEN		2347	/* d11 max RTS length */
 
+/* dot11FragmentationThreshold */
+#define DOT11_MIN_FRAG_LEN		256	/* d11 min fragmentation length */
+#define DOT11_MAX_FRAG_LEN		2346	/* Max frag is also limited by aMPDUMaxLength
+						* of the attached PHY
+						*/
+#define DOT11_DEFAULT_FRAG_LEN		2346	/* d11 default fragmentation length */
 
-#define DOT11_MIN_DTIM_PERIOD       1
-#define DOT11_MAX_DTIM_PERIOD       0xFF
+/* dot11BeaconPeriod */
+#define DOT11_MIN_BEACON_PERIOD		1	/* d11 min beacon period */
+#define DOT11_MAX_BEACON_PERIOD		0xFFFF	/* d11 max beacon period */
 
+/* dot11DTIMPeriod */
+#define DOT11_MIN_DTIM_PERIOD		1	/* d11 min DTIM period */
+#define DOT11_MAX_DTIM_PERIOD		0xFF	/* d11 max DTIM period */
 
-#define DOT11_LLC_SNAP_HDR_LEN      8
-#define DOT11_OUI_LEN           3
+/* 802.2 LLC/SNAP header used by 802.11 per 802.1H */
+#define DOT11_LLC_SNAP_HDR_LEN		8	/* d11 LLC/SNAP header length */
+#define DOT11_OUI_LEN			3	/* d11 OUI length */
 BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
-	uint8   dsap;
-	uint8   ssap;
-	uint8   ctl;
-	uint8   oui[DOT11_OUI_LEN];
-	uint16  type;
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[DOT11_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
+						 * Bridge-Tunnel: 0x00 0x00 0xF8
+						 */
+	uint16	type;				/* ethertype */
 } BWL_POST_PACKED_STRUCT;
 
+/* RFC1042 header used by 802.11 per 802.1H */
+#define RFC1042_HDR_LEN	(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)	/* RCF1042 header length */
 
-#define RFC1042_HDR_LEN (ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)
-
-
-
+/* Generic 802.11 MAC header */
+/*
+ * N.B.: This struct reflects the full 4 address 802.11 MAC header.
+ *		 The fields are defined such that the shorter 1, 2, and 3
+ *		 address headers just use the first k fields.
+ */
 BWL_PRE_PACKED_STRUCT struct dot11_header {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   a1;
-	struct ether_addr   a2;
-	struct ether_addr   a3;
-	uint16          seq;
-	struct ether_addr   a4;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	a1;		/* address 1 */
+	struct ether_addr	a2;		/* address 2 */
+	struct ether_addr	a3;		/* address 3 */
+	uint16			seq;		/* sequence control */
+	struct ether_addr	a4;		/* address 4 */
 } BWL_POST_PACKED_STRUCT;
 
-
+/* Control frames */
 
 BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   ra;
-	struct ether_addr   ta;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	ta;		/* transmitter address */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_RTS_LEN       16
+#define	DOT11_RTS_LEN		16		/* d11 RTS frame length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   ra;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_CTS_LEN       10
+#define	DOT11_CTS_LEN		10		/* d11 CTS frame length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   ra;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_ACK_LEN       10
+#define	DOT11_ACK_LEN		10		/* d11 ACK frame length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   bssid;
-	struct ether_addr   ta;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* AID */
+	struct ether_addr	bssid;		/* receiver address, STA in AP */
+	struct ether_addr	ta;		/* transmitter address */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_PS_POLL_LEN   16
+#define	DOT11_PS_POLL_LEN	16		/* d11 PS poll frame length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   ra;
-	struct ether_addr   bssid;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	bssid;		/* transmitter address, STA in AP */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_CS_END_LEN    16
-
+#define	DOT11_CS_END_LEN	16		/* d11 CF-END frame length */
 
+/* RWL wifi protocol: The Vendor Specific Action frame is defined for vendor-specific signaling
+*  category+OUI+vendor specific content ( this can be variable)
+*/
 BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
-	uint8   category;
-	uint8   OUI[3];
-	uint8   type;
-	uint8   subtype;
-	uint8   data[1040];
+	uint8	category;
+	uint8	OUI[3];
+	uint8	type;
+	uint8	subtype;
+	uint8	data[1040];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
 
-
+/* generic vender specific action frame with variable length */
 BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
-	uint8   category;
-	uint8   OUI[3];
-	uint8   type;
-	uint8   subtype;
-	uint8   data[1];
+	uint8	category;
+	uint8	OUI[3];
+	uint8	type;
+	uint8	subtype;
+	uint8	data[1];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
-#define DOT11_ACTION_VS_HDR_LEN 6
-
-#define BCM_ACTION_OUI_BYTE0    0x00
-#define BCM_ACTION_OUI_BYTE1    0x90
-#define BCM_ACTION_OUI_BYTE2    0x4c
+#define DOT11_ACTION_VS_HDR_LEN	6
 
+#define BCM_ACTION_OUI_BYTE0	0x00
+#define BCM_ACTION_OUI_BYTE1	0x90
+#define BCM_ACTION_OUI_BYTE2	0x4c
 
-#define DOT11_BA_CTL_POLICY_NORMAL  0x0000
-#define DOT11_BA_CTL_POLICY_NOACK   0x0001
-#define DOT11_BA_CTL_POLICY_MASK    0x0001
+/* BA/BAR Control parameters */
+#define DOT11_BA_CTL_POLICY_NORMAL	0x0000	/* normal ack */
+#define DOT11_BA_CTL_POLICY_NOACK	0x0001	/* no ack */
+#define DOT11_BA_CTL_POLICY_MASK	0x0001	/* ack policy mask */
 
-#define DOT11_BA_CTL_MTID       0x0002
-#define DOT11_BA_CTL_COMPRESSED     0x0004
+#define DOT11_BA_CTL_MTID		0x0002	/* multi tid BA */
+#define DOT11_BA_CTL_COMPRESSED		0x0004	/* compressed bitmap */
 
-#define DOT11_BA_CTL_NUMMSDU_MASK   0x0FC0
-#define DOT11_BA_CTL_NUMMSDU_SHIFT  6
-
-#define DOT11_BA_CTL_TID_MASK       0xF000
-#define DOT11_BA_CTL_TID_SHIFT      12
+#define DOT11_BA_CTL_NUMMSDU_MASK	0x0FC0	/* num msdu in bitmap mask */
+#define DOT11_BA_CTL_NUMMSDU_SHIFT	6	/* num msdu in bitmap shift */
 
+#define DOT11_BA_CTL_TID_MASK		0xF000	/* tid mask */
+#define DOT11_BA_CTL_TID_SHIFT		12	/* tid shift */
 
+/* control frame header (BA/BAR) */
 BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   ra;
-	struct ether_addr   ta;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	ta;		/* transmitter address */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_CTL_HDR_LEN   16
-
+#define DOT11_CTL_HDR_LEN	16		/* control frame hdr len */
 
+/* BAR frame payload */
 BWL_PRE_PACKED_STRUCT struct dot11_bar {
-	uint16          bar_control;
-	uint16          seqnum;
+	uint16			bar_control;	/* BAR Control */
+	uint16			seqnum;		/* Starting Sequence control */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_BAR_LEN       4
-
-#define DOT11_BA_BITMAP_LEN 128
-#define DOT11_BA_CMP_BITMAP_LEN 8
+#define DOT11_BAR_LEN		4		/* BAR frame payload length */
 
+#define DOT11_BA_BITMAP_LEN	128		/* bitmap length */
+#define DOT11_BA_CMP_BITMAP_LEN	8		/* compressed bitmap length */
+/* BA frame payload */
 BWL_PRE_PACKED_STRUCT struct dot11_ba {
-	uint16          ba_control;
-	uint16          seqnum;
-	uint8           bitmap[DOT11_BA_BITMAP_LEN];
+	uint16			ba_control;	/* BA Control */
+	uint16			seqnum;		/* Starting Sequence control */
+	uint8			bitmap[DOT11_BA_BITMAP_LEN];	/* Block Ack Bitmap */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_BA_LEN        4
-
+#define DOT11_BA_LEN		4		/* BA frame payload len (wo bitmap) */
 
+/* Management frame header */
 BWL_PRE_PACKED_STRUCT struct dot11_management_header {
-	uint16          fc;
-	uint16          durid;
-	struct ether_addr   da;
-	struct ether_addr   sa;
-	struct ether_addr   bssid;
-	uint16          seq;
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	da;		/* receiver address */
+	struct ether_addr	sa;		/* transmitter address */
+	struct ether_addr	bssid;		/* BSS ID */
+	uint16			seq;		/* sequence control */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_MGMT_HDR_LEN  24
-
+#define	DOT11_MGMT_HDR_LEN	24		/* d11 management header length */
 
+/* Management frame payloads */
 
 BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
-	uint32          timestamp[2];
-	uint16          beacon_interval;
-	uint16          capability;
+	uint32			timestamp[2];
+	uint16			beacon_interval;
+	uint16			capability;
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_BCN_PRB_LEN   12
-#define DOT11_BCN_PRB_FIXED_LEN 12
+#define	DOT11_BCN_PRB_LEN	12		/* 802.11 beacon/probe frame fixed length */
+#define	DOT11_BCN_PRB_FIXED_LEN	12		/* 802.11 beacon/probe frame fixed length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_auth {
-	uint16          alg;
-	uint16          seq;
-	uint16          status;
+	uint16			alg;		/* algorithm */
+	uint16			seq;		/* sequence control */
+	uint16			status;		/* status code */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_AUTH_FIXED_LEN    6
+#define DOT11_AUTH_FIXED_LEN	6		/* length of auth frame without challenge IE */
 
 BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
-	uint16          capability;
-	uint16          listen;
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_ASSOC_REQ_FIXED_LEN   4
+#define DOT11_ASSOC_REQ_FIXED_LEN	4	/* length of assoc frame without info elts */
 
 BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
-	uint16          capability;
-	uint16          listen;
-	struct ether_addr   ap;
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
+	struct ether_addr	ap;		/* Current AP address */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_REASSOC_REQ_FIXED_LEN 10
+#define DOT11_REASSOC_REQ_FIXED_LEN	10	/* length of assoc frame without info elts */
 
 BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
-	uint16          capability;
-	uint16          status;
-	uint16          aid;
+	uint16			capability;	/* capability information */
+	uint16			status;		/* status code */
+	uint16			aid;		/* association ID */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_ASSOC_RESP_FIXED_LEN  6
+#define DOT11_ASSOC_RESP_FIXED_LEN	6	/* length of assoc resp frame without info elts */
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
-	uint8   category;
-	uint8   action;
-	uint8   token;
-	uint8   data[1];
+	uint8	category;
+	uint8	action;
+	uint8	token;
+	uint8	data[1];
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_ACTION_MEASURE_LEN    3
+#define DOT11_ACTION_MEASURE_LEN	3	/* d11 action measurement header length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
-	uint8   category;
-	uint8   action;
-	uint8   ch_width;
+	uint8	category;
+	uint8	action;
+	uint8	ch_width;
 } BWL_POST_PACKED_STRUCT;
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
-	uint8   category;
-	uint8   action;
-	uint8   control;
+	uint8	category;
+	uint8	action;
+	uint8	control;
 } BWL_POST_PACKED_STRUCT;
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
@@ -289,10 +298,16 @@ BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
 	uint16	id;
 } BWL_POST_PACKED_STRUCT;
 
-#define SM_PWRSAVE_ENABLE   1
-#define SM_PWRSAVE_MODE     2
+BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
+	uint8	category;
+	uint8	action;
+	uint8	mode;
+} BWL_POST_PACKED_STRUCT;
 
+#define SM_PWRSAVE_ENABLE	1
+#define SM_PWRSAVE_MODE		2
 
+/* ************* 802.11h related definitions. ************* */
 BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
 	uint8 id;
 	uint8 len;
@@ -313,7 +328,7 @@ BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
 	uint8 margin;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_tpc_rep dot11_tpc_rep_t;
-#define DOT11_MNG_IE_TPC_REPORT_LEN 2
+#define DOT11_MNG_IE_TPC_REPORT_LEN	2 	/* length of IE data, not including 2 byte header */
 
 BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
 	uint8 id;
@@ -323,108 +338,143 @@ BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_supp_channels dot11_supp_channels_t;
 
-
+/* Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
+ * offset for 40MHz operation.  The possible 3 values are:
+ * 1 = above control channel
+ * 3 = below control channel
+ * 0 = no extension channel
+ */
 BWL_PRE_PACKED_STRUCT struct dot11_extch {
-	uint8   id;
-	uint8   len;
-	uint8   extch;
+	uint8	id;		/* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
+	uint8	len;		/* IE length */
+	uint8	extch;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_extch dot11_extch_ie_t;
 
 BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
-	uint8   id;
-	uint8   len;
-	uint8   oui[3];
-	uint8   type;
-	uint8   extch;
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
+	uint8	type;           /* type inidicates what follows */
+	uint8	extch;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
 
-#define BRCM_EXTCH_IE_LEN   5
-#define BRCM_EXTCH_IE_TYPE  53
-#define DOT11_EXTCH_IE_LEN  1
-#define DOT11_EXT_CH_MASK   0x03
-#define DOT11_EXT_CH_UPPER  0x01
-#define DOT11_EXT_CH_LOWER  0x03
-#define DOT11_EXT_CH_NONE   0x00
+#define BRCM_EXTCH_IE_LEN	5
+#define BRCM_EXTCH_IE_TYPE	53	/* 802.11n ID not yet assigned */
+#define DOT11_EXTCH_IE_LEN	1
+#define DOT11_EXT_CH_MASK	0x03	/* extension channel mask */
+#define DOT11_EXT_CH_UPPER	0x01	/* ext. ch. on upper sb */
+#define DOT11_EXT_CH_LOWER	0x03	/* ext. ch. on lower sb */
+#define DOT11_EXT_CH_NONE	0x00	/* no extension ch.  */
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
-	uint8   category;
-	uint8   action;
-	uint8   data[1];
+	uint8	category;
+	uint8	action;
+	uint8	data[1];
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_ACTION_FRMHDR_LEN 2
-
+#define DOT11_ACTION_FRMHDR_LEN	2
 
+/* CSA IE data structure */
 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
-	uint8 id;
-	uint8 len;
-	uint8 mode;
-	uint8 channel;
-	uint8 count;
+	uint8 id;	/* id DOT11_MNG_CHANNEL_SWITCH_ID */
+	uint8 len;	/* length of IE */
+	uint8 mode;	/* mode 0 or 1 */
+	uint8 channel;	/* channel switch to */
+	uint8 count;	/* number of beacons before switching */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
 
-#define DOT11_SWITCH_IE_LEN 3
-
-#define DOT11_CSA_MODE_ADVISORY     0
-#define DOT11_CSA_MODE_NO_TX        1
+#define DOT11_SWITCH_IE_LEN	3	/* length of IE data, not including 2 byte header */
+/* CSA mode - 802.11h-2003 $7.3.2.20 */
+#define DOT11_CSA_MODE_ADVISORY		0	/* no DOT11_CSA_MODE_NO_TX restriction imposed */
+#define DOT11_CSA_MODE_NO_TX		1	/* no transmission upon receiving CSA frame. */
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
-	uint8   category;
-	uint8   action;
-	dot11_chan_switch_ie_t chan_switch_ie;
-	dot11_brcm_extch_ie_t extch_ie;
+	uint8	category;
+	uint8	action;
+	dot11_chan_switch_ie_t chan_switch_ie;	/* for switch IE */
+	dot11_brcm_extch_ie_t extch_ie;		/* extension channel offset */
 } BWL_POST_PACKED_STRUCT;
 
 BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
-	uint8 mode;
-	uint8 reg;
-	uint8 channel;
-	uint8 count;
+	uint8 mode;	/* mode 0 or 1 */
+	uint8 reg;	/* regulatory class */
+	uint8 channel;	/* channel switch to */
+	uint8 count;	/* number of beacons before switching */
 } BWL_POST_PACKED_STRUCT;
 
-
+/* 11n Extended Channel Switch IE data structure */
 BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
-	uint8 id;
-	uint8 len;
-	struct dot11_csa_body b;
+	uint8 id;	/* id DOT11_MNG_EXT_CHANNEL_SWITCH_ID */
+	uint8 len;	/* length of IE */
+	struct dot11_csa_body b;	/* body of the ie */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
-#define DOT11_EXT_CSA_IE_LEN    4
+#define DOT11_EXT_CSA_IE_LEN	4	/* length of extended channel switch IE body */
 
 BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
-	uint8   category;
-	uint8   action;
-	dot11_ext_csa_ie_t chan_switch_ie;
+	uint8	category;
+	uint8	action;
+	dot11_ext_csa_ie_t chan_switch_ie;	/* for switch IE */
 } BWL_POST_PACKED_STRUCT;
 
 BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
-	uint8   category;
-	uint8   action;
-	struct dot11_csa_body b;
+	uint8	category;
+	uint8	action;
+	struct dot11_csa_body b;	/* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+
+/*  Wide Bandwidth Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
+	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+	uint8 len;				/* length of IE */
+	uint8 channel_width;			/* new channel width */
+	uint8 center_frequency_segment_0;	/* center frequency segment 0 */
+	uint8 center_frequency_segment_1;	/* center frequency segment 1 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
+
+#define DOT11_WIDE_BW_SWITCH_IE_LEN     3       /* length of IE data, not including 2 byte header */
+
+/* Channel Switch Wrapper IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
+	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+	uint8 len;				/* length of IE */
+	dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
 } BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
+
+/* VHT Transmit Power Envelope IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
+	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+	uint8 len;				/* length of IE */
+	uint8 transmit_power_info;
+	uint8 local_max_transmit_power_20;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_vht_transmit_power_envelope dot11_vht_transmit_power_envelope_ie_t;
+
 
 BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
-	uint8   id;
-	uint8   len;
-	uint8   info;
+	uint8	id;
+	uint8	len;
+	uint8	info;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_obss_coex dot11_obss_coex_t;
-#define DOT11_OBSS_COEXINFO_LEN 1
+#define DOT11_OBSS_COEXINFO_LEN	1	/* length of OBSS Coexistence INFO IE */
 
-#define DOT11_OBSS_COEX_INFO_REQ        0x01
-#define DOT11_OBSS_COEX_40MHZ_INTOLERANT    0x02
-#define DOT11_OBSS_COEX_20MHZ_WIDTH_REQ 0x04
+#define	DOT11_OBSS_COEX_INFO_REQ		0x01
+#define	DOT11_OBSS_COEX_40MHZ_INTOLERANT	0x02
+#define	DOT11_OBSS_COEX_20MHZ_WIDTH_REQ	0x04
 
 BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
-	uint8   id;
-	uint8   len;
-	uint8   regclass;
-	uint8   chanlist[1];
+	uint8	id;
+	uint8	len;
+	uint8	regclass;
+	uint8	chanlist[1];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
-#define DOT11_OBSS_CHANLIST_FIXED_LEN   1
+#define DOT11_OBSS_CHANLIST_FIXED_LEN	1	/* fixed length of regclass */
 
 BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
 	uint8 id;
@@ -433,58 +483,73 @@ BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_extcap_ie dot11_extcap_ie_t;
 
-#define DOT11_EXTCAP_LEN_MAX	7
+#define DOT11_EXTCAP_LEN_MAX	8
+
 #define DOT11_EXTCAP_LEN_COEX	1
 #define DOT11_EXTCAP_LEN_BT	3
 #define DOT11_EXTCAP_LEN_IW	4
 #define DOT11_EXTCAP_LEN_SI	6
 
 #define DOT11_EXTCAP_LEN_TDLS	5
+#define DOT11_11AC_EXTCAP_LEN_TDLS	8
+
+#define DOT11_EXTCAP_LEN_FMS			2
+#define DOT11_EXTCAP_LEN_PROXY_ARP		2
+#define DOT11_EXTCAP_LEN_TFS			3
+#define DOT11_EXTCAP_LEN_WNM_SLEEP		3
+#define DOT11_EXTCAP_LEN_TIMBC			3
+#define DOT11_EXTCAP_LEN_BSSTRANS		3
+#define DOT11_EXTCAP_LEN_DMS			4
+#define DOT11_EXTCAP_LEN_WNM_NOTIFICATION	6
+#define DOT11_EXTCAP_LEN_TDLS_WBW		8
+#define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION	8
+
 BWL_PRE_PACKED_STRUCT struct dot11_extcap {
-	uint8 extcap[DOT11_EXTCAP_LEN_TDLS];
+	uint8 extcap[DOT11_EXTCAP_LEN_MAX];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_extcap dot11_extcap_t;
 
-
-#define TDLS_CAP_TDLS			37		
-#define TDLS_CAP_PU_BUFFER_STA	28		
-#define TDLS_CAP_PEER_PSM		20		
-#define TDLS_CAP_CH_SW			30		
-#define TDLS_CAP_PROH			38		
-#define TDLS_CAP_CH_SW_PROH		39		
-
-#define TDLS_CAP_MAX_BIT		39		
-
-
-
-#define DOT11_MEASURE_TYPE_BASIC    0
-#define DOT11_MEASURE_TYPE_CCA      1
-#define DOT11_MEASURE_TYPE_RPI      2
-#define DOT11_MEASURE_TYPE_CHLOAD       3
-#define DOT11_MEASURE_TYPE_NOISE        4
-#define DOT11_MEASURE_TYPE_BEACON       5
-#define DOT11_MEASURE_TYPE_FRAME    6
-#define DOT11_MEASURE_TYPE_STATS        7
-#define DOT11_MEASURE_TYPE_LCI      8
-#define DOT11_MEASURE_TYPE_TXSTREAM     9
-#define DOT11_MEASURE_TYPE_PAUSE        255
-
-
-#define DOT11_MEASURE_MODE_PARALLEL     (1<<0)
-#define DOT11_MEASURE_MODE_ENABLE   (1<<1)
-#define DOT11_MEASURE_MODE_REQUEST  (1<<2)
-#define DOT11_MEASURE_MODE_REPORT   (1<<3)
-#define DOT11_MEASURE_MODE_DUR  (1<<4)
-
-#define DOT11_MEASURE_MODE_LATE     (1<<0)
-#define DOT11_MEASURE_MODE_INCAPABLE    (1<<1)
-#define DOT11_MEASURE_MODE_REFUSED  (1<<2)
-
-#define DOT11_MEASURE_BASIC_MAP_BSS ((uint8)(1<<0))
-#define DOT11_MEASURE_BASIC_MAP_OFDM    ((uint8)(1<<1))
-#define DOT11_MEASURE_BASIC_MAP_UKNOWN  ((uint8)(1<<2))
-#define DOT11_MEASURE_BASIC_MAP_RADAR   ((uint8)(1<<3))
-#define DOT11_MEASURE_BASIC_MAP_UNMEAS  ((uint8)(1<<4))
+/* TDLS Capabilities */
+#define DOT11_TDLS_CAP_TDLS			37		/* TDLS support */
+#define DOT11_TDLS_CAP_PU_BUFFER_STA	28		/* TDLS Peer U-APSD buffer STA support */
+#define DOT11_TDLS_CAP_PEER_PSM		20		/* TDLS Peer PSM support */
+#define DOT11_TDLS_CAP_CH_SW			30		/* TDLS Channel switch */
+#define DOT11_TDLS_CAP_PROH			38		/* TDLS prohibited */
+#define DOT11_TDLS_CAP_CH_SW_PROH		39		/* TDLS Channel switch prohibited */
+#define DOT11_TDLS_CAP_TDLS_WIDER_BW	61	/* TDLS Wider Band-Width */
+
+#define TDLS_CAP_MAX_BIT		39		/* TDLS max bit defined in ext cap */
+
+/* 802.11h/802.11k Measurement Request/Report IEs */
+/* Measurement Type field */
+#define DOT11_MEASURE_TYPE_BASIC 	0	/* d11 measurement basic type */
+#define DOT11_MEASURE_TYPE_CCA 		1	/* d11 measurement CCA type */
+#define DOT11_MEASURE_TYPE_RPI		2	/* d11 measurement RPI type */
+#define DOT11_MEASURE_TYPE_CHLOAD		3	/* d11 measurement Channel Load type */
+#define DOT11_MEASURE_TYPE_NOISE		4	/* d11 measurement Noise Histogram type */
+#define DOT11_MEASURE_TYPE_BEACON		5	/* d11 measurement Beacon type */
+#define DOT11_MEASURE_TYPE_FRAME	6	/* d11 measurement Frame type */
+#define DOT11_MEASURE_TYPE_STAT		7	/* d11 measurement STA Statistics type */
+#define DOT11_MEASURE_TYPE_LCI		8	/* d11 measurement LCI type */
+#define DOT11_MEASURE_TYPE_TXSTREAM		9	/* d11 measurement TX Stream type */
+#define DOT11_MEASURE_TYPE_PAUSE		255	/* d11 measurement pause type */
+
+/* Measurement Request Modes */
+#define DOT11_MEASURE_MODE_PARALLEL 	(1<<0)	/* d11 measurement parallel */
+#define DOT11_MEASURE_MODE_ENABLE 	(1<<1)	/* d11 measurement enable */
+#define DOT11_MEASURE_MODE_REQUEST	(1<<2)	/* d11 measurement request */
+#define DOT11_MEASURE_MODE_REPORT 	(1<<3)	/* d11 measurement report */
+#define DOT11_MEASURE_MODE_DUR 	(1<<4)	/* d11 measurement dur mandatory */
+/* Measurement Report Modes */
+#define DOT11_MEASURE_MODE_LATE 	(1<<0)	/* d11 measurement late */
+#define DOT11_MEASURE_MODE_INCAPABLE	(1<<1)	/* d11 measurement incapable */
+#define DOT11_MEASURE_MODE_REFUSED	(1<<2)	/* d11 measurement refuse */
+/* Basic Measurement Map bits */
+#define DOT11_MEASURE_BASIC_MAP_BSS	((uint8)(1<<0))	/* d11 measurement basic map BSS */
+#define DOT11_MEASURE_BASIC_MAP_OFDM	((uint8)(1<<1))	/* d11 measurement map OFDM */
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN	((uint8)(1<<2))	/* d11 measurement map unknown */
+#define DOT11_MEASURE_BASIC_MAP_RADAR	((uint8)(1<<3))	/* d11 measurement map radar */
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS	((uint8)(1<<4))	/* d11 measurement map unmeasuremnt */
 
 BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
 	uint8 id;
@@ -497,9 +562,9 @@ BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
 	uint16 duration;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_meas_req dot11_meas_req_t;
-#define DOT11_MNG_IE_MREQ_LEN 14
-
-#define DOT11_MNG_IE_MREQ_FIXED_LEN 3
+#define DOT11_MNG_IE_MREQ_LEN 14	/* d11 measurement request IE length */
+/* length of Measure Request IE data not including variable len */
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3	/* d11 measurement request IE fixed length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
 	uint8 id;
@@ -520,8 +585,8 @@ BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_meas_rep dot11_meas_rep_t;
 
-
-#define DOT11_MNG_IE_MREP_FIXED_LEN 3
+/* length of Measure Report IE data not including variable len */
+#define DOT11_MNG_IE_MREP_FIXED_LEN	3	/* d11 measurement response IE fixed length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
 	uint8 channel;
@@ -530,15 +595,15 @@ BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
 	uint8 map;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
-#define DOT11_MEASURE_BASIC_REP_LEN 12
+#define DOT11_MEASURE_BASIC_REP_LEN	12	/* d11 measurement basic report length */
 
 BWL_PRE_PACKED_STRUCT struct dot11_quiet {
 	uint8 id;
 	uint8 len;
-	uint8 count;
-	uint8 period;
-	uint16 duration;
-	uint16 offset;
+	uint8 count;	/* TBTTs until beacon interval in quiet starts */
+	uint8 period;	/* Beacon intervals between periodic quiet periods ? */
+	uint16 duration;	/* Length of quiet period, in TU's */
+	uint16 offset;	/* TU's offset from TBTT in Count field */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_quiet dot11_quiet_t;
 
@@ -557,32 +622,32 @@ BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
 
-
-#define WME_OUI         "\x00\x50\xf2"
-#define WME_OUI_LEN     3
-#define WME_OUI_TYPE        2
-#define WME_TYPE        2
-#define WME_SUBTYPE_IE      0
-#define WME_SUBTYPE_PARAM_IE    1
-#define WME_SUBTYPE_TSPEC   2
-#define WME_VER			1	
-
-
-#define AC_BE           0
-#define AC_BK           1
-#define AC_VI           2
-#define AC_VO           3
-#define AC_COUNT        4
-
-typedef uint8 ac_bitmap_t;
-
-#define AC_BITMAP_NONE      0x0
-#define AC_BITMAP_ALL       0xf
-#define AC_BITMAP_TST(ab, ac)   (((ab) & (1 << (ac))) != 0)
-#define AC_BITMAP_SET(ab, ac)   (((ab) |= (1 << (ac))))
+/* WME Elements */
+#define WME_OUI			"\x00\x50\xf2"	/* WME OUI */
+#define WME_OUI_LEN		3
+#define WME_OUI_TYPE		2	/* WME type */
+#define WME_TYPE		2	/* WME type, deprecated */
+#define WME_SUBTYPE_IE		0	/* Information Element */
+#define WME_SUBTYPE_PARAM_IE	1	/* Parameter Element */
+#define WME_SUBTYPE_TSPEC	2	/* Traffic Specification */
+#define WME_VER			1	/* WME version */
+
+/* WME Access Category Indices (ACIs) */
+#define AC_BE			0	/* Best Effort */
+#define AC_BK			1	/* Background */
+#define AC_VI			2	/* Video */
+#define AC_VO			3	/* Voice */
+#define AC_COUNT		4	/* number of ACs */
+
+typedef uint8 ac_bitmap_t;	/* AC bitmap of (1 << AC_xx) */
+
+#define AC_BITMAP_NONE		0x0	/* No ACs */
+#define AC_BITMAP_ALL		0xf	/* All ACs */
+#define AC_BITMAP_TST(ab, ac)	(((ab) & (1 << (ac))) != 0)
+#define AC_BITMAP_SET(ab, ac)	(((ab) |= (1 << (ac))))
 #define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
 
-
+/* WME Information Element (IE) */
 BWL_PRE_PACKED_STRUCT struct wme_ie {
 	uint8 oui[3];
 	uint8 type;
@@ -591,16 +656,16 @@ BWL_PRE_PACKED_STRUCT struct wme_ie {
 	uint8 qosinfo;
 } BWL_POST_PACKED_STRUCT;
 typedef struct wme_ie wme_ie_t;
-#define WME_IE_LEN 7
+#define WME_IE_LEN 7	/* WME IE length */
 
 BWL_PRE_PACKED_STRUCT struct edcf_acparam {
-	uint8   ACI;
-	uint8   ECW;
-	uint16  TXOP;
+	uint8	ACI;
+	uint8	ECW;
+	uint16  TXOP;		/* stored in network order (ls octet first) */
 } BWL_POST_PACKED_STRUCT;
 typedef struct edcf_acparam edcf_acparam_t;
 
-
+/* WME Parameter Element (PE) */
 BWL_PRE_PACKED_STRUCT struct wme_param_ie {
 	uint8 oui[3];
 	uint8 type;
@@ -611,126 +676,126 @@ BWL_PRE_PACKED_STRUCT struct wme_param_ie {
 	edcf_acparam_t acparam[AC_COUNT];
 } BWL_POST_PACKED_STRUCT;
 typedef struct wme_param_ie wme_param_ie_t;
-#define WME_PARAM_IE_LEN            24
-
-
-#define WME_QI_AP_APSD_MASK         0x80
-#define WME_QI_AP_APSD_SHIFT        7
-#define WME_QI_AP_COUNT_MASK        0x0f
-#define WME_QI_AP_COUNT_SHIFT       0
-
-
-#define WME_QI_STA_MAXSPLEN_MASK    0x60
-#define WME_QI_STA_MAXSPLEN_SHIFT   5
-#define WME_QI_STA_APSD_ALL_MASK    0xf
-#define WME_QI_STA_APSD_ALL_SHIFT   0
-#define WME_QI_STA_APSD_BE_MASK     0x8
-#define WME_QI_STA_APSD_BE_SHIFT    3
-#define WME_QI_STA_APSD_BK_MASK     0x4
-#define WME_QI_STA_APSD_BK_SHIFT    2
-#define WME_QI_STA_APSD_VI_MASK     0x2
-#define WME_QI_STA_APSD_VI_SHIFT    1
-#define WME_QI_STA_APSD_VO_MASK     0x1
-#define WME_QI_STA_APSD_VO_SHIFT    0
-
-
-#define EDCF_AIFSN_MIN               1
-#define EDCF_AIFSN_MAX               15
-#define EDCF_AIFSN_MASK              0x0f
-#define EDCF_ACM_MASK                0x10
-#define EDCF_ACI_MASK                0x60
-#define EDCF_ACI_SHIFT               5
-#define EDCF_AIFSN_SHIFT             12
-
-
-#define EDCF_ECW_MIN                 0
-#define EDCF_ECW_MAX                 15
+#define WME_PARAM_IE_LEN            24          /* WME Parameter IE length */
+
+/* QoS Info field for IE as sent from AP */
+#define WME_QI_AP_APSD_MASK         0x80        /* U-APSD Supported mask */
+#define WME_QI_AP_APSD_SHIFT        7           /* U-APSD Supported shift */
+#define WME_QI_AP_COUNT_MASK        0x0f        /* Parameter set count mask */
+#define WME_QI_AP_COUNT_SHIFT       0           /* Parameter set count shift */
+
+/* QoS Info field for IE as sent from STA */
+#define WME_QI_STA_MAXSPLEN_MASK    0x60        /* Max Service Period Length mask */
+#define WME_QI_STA_MAXSPLEN_SHIFT   5           /* Max Service Period Length shift */
+#define WME_QI_STA_APSD_ALL_MASK    0xf         /* APSD all AC bits mask */
+#define WME_QI_STA_APSD_ALL_SHIFT   0           /* APSD all AC bits shift */
+#define WME_QI_STA_APSD_BE_MASK     0x8         /* APSD AC_BE mask */
+#define WME_QI_STA_APSD_BE_SHIFT    3           /* APSD AC_BE shift */
+#define WME_QI_STA_APSD_BK_MASK     0x4         /* APSD AC_BK mask */
+#define WME_QI_STA_APSD_BK_SHIFT    2           /* APSD AC_BK shift */
+#define WME_QI_STA_APSD_VI_MASK     0x2         /* APSD AC_VI mask */
+#define WME_QI_STA_APSD_VI_SHIFT    1           /* APSD AC_VI shift */
+#define WME_QI_STA_APSD_VO_MASK     0x1         /* APSD AC_VO mask */
+#define WME_QI_STA_APSD_VO_SHIFT    0           /* APSD AC_VO shift */
+
+/* ACI */
+#define EDCF_AIFSN_MIN               1           /* AIFSN minimum value */
+#define EDCF_AIFSN_MAX               15          /* AIFSN maximum value */
+#define EDCF_AIFSN_MASK              0x0f        /* AIFSN mask */
+#define EDCF_ACM_MASK                0x10        /* ACM mask */
+#define EDCF_ACI_MASK                0x60        /* ACI mask */
+#define EDCF_ACI_SHIFT               5           /* ACI shift */
+#define EDCF_AIFSN_SHIFT             12          /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
+
+/* ECW */
+#define EDCF_ECW_MIN                 0           /* cwmin/cwmax exponent minimum value */
+#define EDCF_ECW_MAX                 15          /* cwmin/cwmax exponent maximum value */
 #define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
-#define EDCF_ECWMIN_MASK             0x0f
-#define EDCF_ECWMAX_MASK             0xf0
-#define EDCF_ECWMAX_SHIFT            4
+#define EDCF_ECWMIN_MASK             0x0f        /* cwmin exponent form mask */
+#define EDCF_ECWMAX_MASK             0xf0        /* cwmax exponent form mask */
+#define EDCF_ECWMAX_SHIFT            4           /* cwmax exponent form shift */
 
-
-#define EDCF_TXOP_MIN                0
-#define EDCF_TXOP_MAX                65535
+/* TXOP */
+#define EDCF_TXOP_MIN                0           /* TXOP minimum value */
+#define EDCF_TXOP_MAX                65535       /* TXOP maximum value */
 #define EDCF_TXOP2USEC(txop)         ((txop) << 5)
 
-
+/* Default BE ACI value for non-WME connection STA */
 #define NON_EDCF_AC_BE_ACI_STA          0x02
 
-
-#define EDCF_AC_BE_ACI_STA           0x03
-#define EDCF_AC_BE_ECW_STA           0xA4
-#define EDCF_AC_BE_TXOP_STA          0x0000
-#define EDCF_AC_BK_ACI_STA           0x27
-#define EDCF_AC_BK_ECW_STA           0xA4
-#define EDCF_AC_BK_TXOP_STA          0x0000
-#define EDCF_AC_VI_ACI_STA           0x42
-#define EDCF_AC_VI_ECW_STA           0x43
-#define EDCF_AC_VI_TXOP_STA          0x005e
-#define EDCF_AC_VO_ACI_STA           0x62
-#define EDCF_AC_VO_ECW_STA           0x32
-#define EDCF_AC_VO_TXOP_STA          0x002f
-
-
-#define EDCF_AC_BE_ACI_AP            0x03
-#define EDCF_AC_BE_ECW_AP            0x64
-#define EDCF_AC_BE_TXOP_AP           0x0000
-#define EDCF_AC_BK_ACI_AP            0x27
-#define EDCF_AC_BK_ECW_AP            0xA4
-#define EDCF_AC_BK_TXOP_AP           0x0000
-#define EDCF_AC_VI_ACI_AP            0x41
-#define EDCF_AC_VI_ECW_AP            0x43
-#define EDCF_AC_VI_TXOP_AP           0x005e
-#define EDCF_AC_VO_ACI_AP            0x61
-#define EDCF_AC_VO_ECW_AP            0x32
-#define EDCF_AC_VO_TXOP_AP           0x002f
-
-
+/* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12 */
+#define EDCF_AC_BE_ACI_STA           0x03	/* STA ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_STA           0xA4	/* STA ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_STA          0x0000	/* STA TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_STA           0x27	/* STA ACI value for background AC */
+#define EDCF_AC_BK_ECW_STA           0xA4	/* STA ECW value for background AC */
+#define EDCF_AC_BK_TXOP_STA          0x0000	/* STA TXOP value for background AC */
+#define EDCF_AC_VI_ACI_STA           0x42	/* STA ACI value for video AC */
+#define EDCF_AC_VI_ECW_STA           0x43	/* STA ECW value for video AC */
+#define EDCF_AC_VI_TXOP_STA          0x005e	/* STA TXOP value for video AC */
+#define EDCF_AC_VO_ACI_STA           0x62	/* STA ACI value for audio AC */
+#define EDCF_AC_VO_ECW_STA           0x32	/* STA ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_STA          0x002f	/* STA TXOP value for audio AC */
+
+/* Default EDCF parameters that AP uses; WMM draft Table 14 */
+#define EDCF_AC_BE_ACI_AP            0x03	/* AP ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_AP            0x64	/* AP ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_AP           0x0000	/* AP TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_AP            0x27	/* AP ACI value for background AC */
+#define EDCF_AC_BK_ECW_AP            0xA4	/* AP ECW value for background AC */
+#define EDCF_AC_BK_TXOP_AP           0x0000	/* AP TXOP value for background AC */
+#define EDCF_AC_VI_ACI_AP            0x41	/* AP ACI value for video AC */
+#define EDCF_AC_VI_ECW_AP            0x43	/* AP ECW value for video AC */
+#define EDCF_AC_VI_TXOP_AP           0x005e	/* AP TXOP value for video AC */
+#define EDCF_AC_VO_ACI_AP            0x61	/* AP ACI value for audio AC */
+#define EDCF_AC_VO_ECW_AP            0x32	/* AP ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_AP           0x002f	/* AP TXOP value for audio AC */
+
+/* EDCA Parameter IE */
 BWL_PRE_PACKED_STRUCT struct edca_param_ie {
 	uint8 qosinfo;
 	uint8 rsvd;
 	edcf_acparam_t acparam[AC_COUNT];
 } BWL_POST_PACKED_STRUCT;
 typedef struct edca_param_ie edca_param_ie_t;
-#define EDCA_PARAM_IE_LEN            18
-
+#define EDCA_PARAM_IE_LEN            18          /* EDCA Parameter IE length */
 
+/* QoS Capability IE */
 BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
 	uint8 qosinfo;
 } BWL_POST_PACKED_STRUCT;
 typedef struct qos_cap_ie qos_cap_ie_t;
 
 BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
-	uint8 id;
+	uint8 id; 			/* 11, DOT11_MNG_QBSS_LOAD_ID */
 	uint8 length;
-	uint16 station_count;
-	uint8 channel_utilization;
-	uint16 aac;
+	uint16 station_count; 		/* total number of STAs associated */
+	uint8 channel_utilization;	/* % of time, normalized to 255, QAP sensed medium busy */
+	uint16 aac; 			/* available admission capacity */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
-#define BSS_LOAD_IE_SIZE 	7	
-
-
-#define FIXED_MSDU_SIZE 0x8000
-#define MSDU_SIZE_MASK  0x7fff
-
-
+#define BSS_LOAD_IE_SIZE 	7	/* BSS load IE size */
 
-#define INTEGER_SHIFT   13
-#define FRACTION_MASK   0x1FFF
+/* nom_msdu_size */
+#define FIXED_MSDU_SIZE 0x8000		/* MSDU size is fixed */
+#define MSDU_SIZE_MASK	0x7fff		/* (Nominal or fixed) MSDU size */
 
+/* surplus_bandwidth */
+/* Represented as 3 bits of integer, binary point, 13 bits fraction */
+#define	INTEGER_SHIFT	13	/* integer shift */
+#define FRACTION_MASK	0x1FFF	/* fraction mask */
 
+/* Management Notification Frame */
 BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
-	uint8 category;
+	uint8 category;			/* DOT11_ACTION_NOTIFICATION */
 	uint8 action;
 	uint8 token;
 	uint8 status;
-	uint8 data[1];
+	uint8 data[1];			/* Elements */
 } BWL_POST_PACKED_STRUCT;
-#define DOT11_MGMT_NOTIFICATION_LEN 4
-
+#define DOT11_MGMT_NOTIFICATION_LEN 4	/* Fixed length */
 
+/* Timeout Interval IE */
 BWL_PRE_PACKED_STRUCT struct ti_ie {
 	uint8 ti_type;
 	uint32 ti_val;
@@ -739,534 +804,1431 @@ typedef struct ti_ie ti_ie_t;
 #define TI_TYPE_REASSOC_DEADLINE	1
 #define TI_TYPE_KEY_LIFETIME		2
 
-#define WME_ADDTS_REQUEST   0
-#define WME_ADDTS_RESPONSE  1
-#define WME_DELTS_REQUEST   2
-
-
-#define WME_ADMISSION_ACCEPTED      0
-#define WME_INVALID_PARAMETERS      1
-#define WME_ADMISSION_REFUSED       3
+/* WME Action Codes */
+#define WME_ADDTS_REQUEST	0	/* WME ADDTS request */
+#define WME_ADDTS_RESPONSE	1	/* WME ADDTS response */
+#define WME_DELTS_REQUEST	2	/* WME DELTS request */
 
+/* WME Setup Response Status Codes */
+#define WME_ADMISSION_ACCEPTED		0	/* WME admission accepted */
+#define WME_INVALID_PARAMETERS		1	/* WME invalide parameters */
+#define WME_ADMISSION_REFUSED		3	/* WME admission refused */
 
+/* Macro to take a pointer to a beacon or probe response
+ * body and return the char* pointer to the SSID info element
+ */
 #define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
 
+/* Authentication frame payload constants */
+#define DOT11_OPEN_SYSTEM	0	/* d11 open authentication */
+#define DOT11_SHARED_KEY	1	/* d11 shared authentication */
+#define DOT11_FAST_BSS		2	/* d11 fast bss authentication */
+#define DOT11_CHALLENGE_LEN	128	/* d11 challenge text length */
+
+/* Frame control macros */
+#define FC_PVER_MASK		0x3	/* PVER mask */
+#define FC_PVER_SHIFT		0	/* PVER shift */
+#define FC_TYPE_MASK		0xC	/* type mask */
+#define FC_TYPE_SHIFT		2	/* type shift */
+#define FC_SUBTYPE_MASK		0xF0	/* subtype mask */
+#define FC_SUBTYPE_SHIFT	4	/* subtype shift */
+#define FC_TODS			0x100	/* to DS */
+#define FC_TODS_SHIFT		8	/* to DS shift */
+#define FC_FROMDS		0x200	/* from DS */
+#define FC_FROMDS_SHIFT		9	/* from DS shift */
+#define FC_MOREFRAG		0x400	/* more frag. */
+#define FC_MOREFRAG_SHIFT	10	/* more frag. shift */
+#define FC_RETRY		0x800	/* retry */
+#define FC_RETRY_SHIFT		11	/* retry shift */
+#define FC_PM			0x1000	/* PM */
+#define FC_PM_SHIFT		12	/* PM shift */
+#define FC_MOREDATA		0x2000	/* more data */
+#define FC_MOREDATA_SHIFT	13	/* more data shift */
+#define FC_WEP			0x4000	/* WEP */
+#define FC_WEP_SHIFT		14	/* WEP shift */
+#define FC_ORDER		0x8000	/* order */
+#define FC_ORDER_SHIFT		15	/* order shift */
+
+/* sequence control macros */
+#define SEQNUM_SHIFT		4	/* seq. number shift */
+#define SEQNUM_MAX		0x1000	/* max seqnum + 1 */
+#define FRAGNUM_MASK		0xF	/* frag. number mask */
+
+/* Frame Control type/subtype defs */
+
+/* FC Types */
+#define FC_TYPE_MNG		0	/* management type */
+#define FC_TYPE_CTL		1	/* control type */
+#define FC_TYPE_DATA		2	/* data type */
+
+/* Management Subtypes */
+#define FC_SUBTYPE_ASSOC_REQ		0	/* assoc. request */
+#define FC_SUBTYPE_ASSOC_RESP		1	/* assoc. response */
+#define FC_SUBTYPE_REASSOC_REQ		2	/* reassoc. request */
+#define FC_SUBTYPE_REASSOC_RESP		3	/* reassoc. response */
+#define FC_SUBTYPE_PROBE_REQ		4	/* probe request */
+#define FC_SUBTYPE_PROBE_RESP		5	/* probe response */
+#define FC_SUBTYPE_BEACON		8	/* beacon */
+#define FC_SUBTYPE_ATIM			9	/* ATIM */
+#define FC_SUBTYPE_DISASSOC		10	/* disassoc. */
+#define FC_SUBTYPE_AUTH			11	/* authentication */
+#define FC_SUBTYPE_DEAUTH		12	/* de-authentication */
+#define FC_SUBTYPE_ACTION		13	/* action */
+#define FC_SUBTYPE_ACTION_NOACK		14	/* action no-ack */
+
+/* Control Subtypes */
+#define FC_SUBTYPE_CTL_WRAPPER		7	/* Control Wrapper */
+#define FC_SUBTYPE_BLOCKACK_REQ		8	/* Block Ack Req */
+#define FC_SUBTYPE_BLOCKACK		9	/* Block Ack */
+#define FC_SUBTYPE_PS_POLL		10	/* PS poll */
+#define FC_SUBTYPE_RTS			11	/* RTS */
+#define FC_SUBTYPE_CTS			12	/* CTS */
+#define FC_SUBTYPE_ACK			13	/* ACK */
+#define FC_SUBTYPE_CF_END		14	/* CF-END */
+#define FC_SUBTYPE_CF_END_ACK		15	/* CF-END ACK */
+
+/* Data Subtypes */
+#define FC_SUBTYPE_DATA			0	/* Data */
+#define FC_SUBTYPE_DATA_CF_ACK		1	/* Data + CF-ACK */
+#define FC_SUBTYPE_DATA_CF_POLL		2	/* Data + CF-Poll */
+#define FC_SUBTYPE_DATA_CF_ACK_POLL	3	/* Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_NULL			4	/* Null */
+#define FC_SUBTYPE_CF_ACK		5	/* CF-Ack */
+#define FC_SUBTYPE_CF_POLL		6	/* CF-Poll */
+#define FC_SUBTYPE_CF_ACK_POLL		7	/* CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA		8	/* QoS Data */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK	9	/* QoS Data + CF-Ack */
+#define FC_SUBTYPE_QOS_DATA_CF_POLL	10	/* QoS Data + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL	11	/* QoS Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_NULL		12	/* QoS Null */
+#define FC_SUBTYPE_QOS_CF_POLL		14	/* QoS CF-Poll */
+#define FC_SUBTYPE_QOS_CF_ACK_POLL	15	/* QoS CF-Ack + CF-Poll */
+
+/* Data Subtype Groups */
+#define FC_SUBTYPE_ANY_QOS(s)		(((s) & 8) != 0)
+#define FC_SUBTYPE_ANY_NULL(s)		(((s) & 4) != 0)
+#define FC_SUBTYPE_ANY_CF_POLL(s)	(((s) & 2) != 0)
+#define FC_SUBTYPE_ANY_CF_ACK(s)	(((s) & 1) != 0)
+#define FC_SUBTYPE_ANY_PSPOLL(s)	(((s) & 10) != 0)
+
+/* Type/Subtype Combos */
+#define FC_KIND_MASK		(FC_TYPE_MASK | FC_SUBTYPE_MASK)	/* FC kind mask */
+
+#define FC_KIND(t, s)	(((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))	/* FC kind */
+
+#define FC_SUBTYPE(fc)	(((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)	/* Subtype from FC */
+#define FC_TYPE(fc)	(((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)	/* Type from FC */
+
+#define FC_ASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)	/* assoc. request */
+#define FC_ASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)	/* assoc. response */
+#define FC_REASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)	/* reassoc. request */
+#define FC_REASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)	/* reassoc. response */
+#define FC_PROBE_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)	/* probe request */
+#define FC_PROBE_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)	/* probe response */
+#define FC_BEACON	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)		/* beacon */
+#define FC_DISASSOC	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)	/* disassoc */
+#define FC_AUTH		FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)		/* authentication */
+#define FC_DEAUTH	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)		/* deauthentication */
+#define FC_ACTION	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)		/* action */
+#define FC_ACTION_NOACK	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)	/* action no-ack */
+
+#define FC_CTL_WRAPPER	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)	/* Control Wrapper */
+#define FC_BLOCKACK_REQ	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)	/* Block Ack Req */
+#define FC_BLOCKACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)	/* Block Ack */
+#define FC_PS_POLL	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)	/* PS poll */
+#define FC_RTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)		/* RTS */
+#define FC_CTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)		/* CTS */
+#define FC_ACK		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)		/* ACK */
+#define FC_CF_END	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)		/* CF-END */
+#define FC_CF_END_ACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)	/* CF-END ACK */
+
+#define FC_DATA		FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)		/* data */
+#define FC_NULL_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)		/* null data */
+#define FC_DATA_CF_ACK	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)	/* data CF ACK */
+#define FC_QOS_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)	/* QoS data */
+#define FC_QOS_NULL	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)	/* QoS null */
+
+/* QoS Control Field */
+
+/* 802.1D Priority */
+#define QOS_PRIO_SHIFT		0	/* QoS priority shift */
+#define QOS_PRIO_MASK		0x0007	/* QoS priority mask */
+#define QOS_PRIO(qos)		(((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)	/* QoS priority */
+
+/* Traffic Identifier */
+#define QOS_TID_SHIFT		0	/* QoS TID shift */
+#define QOS_TID_MASK		0x000f	/* QoS TID mask */
+#define QOS_TID(qos)		(((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)	/* QoS TID */
+
+/* End of Service Period (U-APSD) */
+#define QOS_EOSP_SHIFT		4	/* QoS End of Service Period shift */
+#define QOS_EOSP_MASK		0x0010	/* QoS End of Service Period mask */
+#define QOS_EOSP(qos)		(((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)	/* Qos EOSP */
+
+/* Ack Policy */
+#define QOS_ACK_NORMAL_ACK	0	/* Normal Ack */
+#define QOS_ACK_NO_ACK		1	/* No Ack (eg mcast) */
+#define QOS_ACK_NO_EXP_ACK	2	/* No Explicit Ack */
+#define QOS_ACK_BLOCK_ACK	3	/* Block Ack */
+#define QOS_ACK_SHIFT		5	/* QoS ACK shift */
+#define QOS_ACK_MASK		0x0060	/* QoS ACK mask */
+#define QOS_ACK(qos)		(((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)	/* QoS ACK */
+
+/* A-MSDU flag */
+#define QOS_AMSDU_SHIFT		7	/* AMSDU shift */
+#define QOS_AMSDU_MASK		0x0080	/* AMSDU mask */
+
+/* Management Frames */
+
+/* Management Frame Constants */
+
+/* Fixed fields */
+#define DOT11_MNG_AUTH_ALGO_LEN		2	/* d11 management auth. algo. length */
+#define DOT11_MNG_AUTH_SEQ_LEN		2	/* d11 management auth. seq. length */
+#define DOT11_MNG_BEACON_INT_LEN	2	/* d11 management beacon interval length */
+#define DOT11_MNG_CAP_LEN		2	/* d11 management cap. length */
+#define DOT11_MNG_AP_ADDR_LEN		6	/* d11 management AP address length */
+#define DOT11_MNG_LISTEN_INT_LEN	2	/* d11 management listen interval length */
+#define DOT11_MNG_REASON_LEN		2	/* d11 management reason length */
+#define DOT11_MNG_AID_LEN		2	/* d11 management AID length */
+#define DOT11_MNG_STATUS_LEN		2	/* d11 management status length */
+#define DOT11_MNG_TIMESTAMP_LEN		8	/* d11 management timestamp length */
+
+/* DUR/ID field in assoc resp is 0xc000 | AID */
+#define DOT11_AID_MASK			0x3fff	/* d11 AID mask */
+
+/* Reason Codes */
+#define DOT11_RC_RESERVED		0	/* d11 RC reserved */
+#define DOT11_RC_UNSPECIFIED		1	/* Unspecified reason */
+#define DOT11_RC_AUTH_INVAL		2	/* Previous authentication no longer valid */
+#define DOT11_RC_DEAUTH_LEAVING		3	/* Deauthenticated because sending station
+						 * is leaving (or has left) IBSS or ESS
+						 */
+#define DOT11_RC_INACTIVITY		4	/* Disassociated due to inactivity */
+#define DOT11_RC_BUSY			5	/* Disassociated because AP is unable to handle
+						 * all currently associated stations
+						 */
+#define DOT11_RC_INVAL_CLASS_2		6	/* Class 2 frame received from
+						 * nonauthenticated station
+						 */
+#define DOT11_RC_INVAL_CLASS_3		7	/* Class 3 frame received from
+						 *  nonassociated station
+						 */
+#define DOT11_RC_DISASSOC_LEAVING	8	/* Disassociated because sending station is
+						 * leaving (or has left) BSS
+						 */
+#define DOT11_RC_NOT_AUTH		9	/* Station requesting (re)association is not
+						 * authenticated with responding station
+						 */
+#define DOT11_RC_BAD_PC			10	/* Unacceptable power capability element */
+#define DOT11_RC_BAD_CHANNELS		11	/* Unacceptable supported channels element */
+/* 12 is unused */
+
+/* 32-39 are QSTA specific reasons added in 11e */
+#define DOT11_RC_UNSPECIFIED_QOS	32	/* unspecified QoS-related reason */
+#define DOT11_RC_INSUFFCIENT_BW		33	/* QAP lacks sufficient bandwidth */
+#define DOT11_RC_EXCESSIVE_FRAMES	34	/* excessive number of frames need ack */
+#define DOT11_RC_TX_OUTSIDE_TXOP	35	/* transmitting outside the limits of txop */
+#define DOT11_RC_LEAVING_QBSS		36	/* QSTA is leaving the QBSS (or restting) */
+#define DOT11_RC_BAD_MECHANISM		37	/* does not want to use the mechanism */
+#define DOT11_RC_SETUP_NEEDED		38	/* mechanism needs a setup */
+#define DOT11_RC_TIMEOUT		39	/* timeout */
+
+#define DOT11_RC_MAX			23	/* Reason codes > 23 are reserved */
 
-#define DOT11_OPEN_SYSTEM   0
-#define DOT11_SHARED_KEY    1
-#define DOT11_FAST_BSS		2	
-#define DOT11_CHALLENGE_LEN	128	
-
-
-#define FC_PVER_MASK        0x3
-#define FC_PVER_SHIFT       0
-#define FC_TYPE_MASK        0xC
-#define FC_TYPE_SHIFT       2
-#define FC_SUBTYPE_MASK     0xF0
-#define FC_SUBTYPE_SHIFT    4
-#define FC_TODS         0x100
-#define FC_TODS_SHIFT       8
-#define FC_FROMDS       0x200
-#define FC_FROMDS_SHIFT     9
-#define FC_MOREFRAG     0x400
-#define FC_MOREFRAG_SHIFT   10
-#define FC_RETRY        0x800
-#define FC_RETRY_SHIFT      11
-#define FC_PM           0x1000
-#define FC_PM_SHIFT     12
-#define FC_MOREDATA     0x2000
-#define FC_MOREDATA_SHIFT   13
-#define FC_WEP          0x4000
-#define FC_WEP_SHIFT        14
-#define FC_ORDER        0x8000
-#define FC_ORDER_SHIFT      15
-
-
-#define SEQNUM_SHIFT        4
-#define SEQNUM_MAX      0x1000
-#define FRAGNUM_MASK        0xF
-
-
-
-
-#define FC_TYPE_MNG     0
-#define FC_TYPE_CTL     1
-#define FC_TYPE_DATA        2
-
-
-#define FC_SUBTYPE_ASSOC_REQ        0
-#define FC_SUBTYPE_ASSOC_RESP       1
-#define FC_SUBTYPE_REASSOC_REQ      2
-#define FC_SUBTYPE_REASSOC_RESP     3
-#define FC_SUBTYPE_PROBE_REQ        4
-#define FC_SUBTYPE_PROBE_RESP       5
-#define FC_SUBTYPE_BEACON       8
-#define FC_SUBTYPE_ATIM         9
-#define FC_SUBTYPE_DISASSOC     10
-#define FC_SUBTYPE_AUTH         11
-#define FC_SUBTYPE_DEAUTH       12
-#define FC_SUBTYPE_ACTION       13
-#define FC_SUBTYPE_ACTION_NOACK     14
-
-
-#define FC_SUBTYPE_CTL_WRAPPER      7
-#define FC_SUBTYPE_BLOCKACK_REQ     8
-#define FC_SUBTYPE_BLOCKACK     9
-#define FC_SUBTYPE_PS_POLL      10
-#define FC_SUBTYPE_RTS          11
-#define FC_SUBTYPE_CTS          12
-#define FC_SUBTYPE_ACK          13
-#define FC_SUBTYPE_CF_END       14
-#define FC_SUBTYPE_CF_END_ACK       15
-
-
-#define FC_SUBTYPE_DATA         0
-#define FC_SUBTYPE_DATA_CF_ACK      1
-#define FC_SUBTYPE_DATA_CF_POLL     2
-#define FC_SUBTYPE_DATA_CF_ACK_POLL 3
-#define FC_SUBTYPE_NULL         4
-#define FC_SUBTYPE_CF_ACK       5
-#define FC_SUBTYPE_CF_POLL      6
-#define FC_SUBTYPE_CF_ACK_POLL      7
-#define FC_SUBTYPE_QOS_DATA     8
-#define FC_SUBTYPE_QOS_DATA_CF_ACK  9
-#define FC_SUBTYPE_QOS_DATA_CF_POLL 10
-#define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL 11
-#define FC_SUBTYPE_QOS_NULL     12
-#define FC_SUBTYPE_QOS_CF_POLL      14
-#define FC_SUBTYPE_QOS_CF_ACK_POLL  15
-
-
-#define FC_SUBTYPE_ANY_QOS(s)       (((s) & 8) != 0)
-#define FC_SUBTYPE_ANY_NULL(s)      (((s) & 4) != 0)
-#define FC_SUBTYPE_ANY_CF_POLL(s)   (((s) & 2) != 0)
-#define FC_SUBTYPE_ANY_CF_ACK(s)    (((s) & 1) != 0)
-
-
-#define FC_KIND_MASK        (FC_TYPE_MASK | FC_SUBTYPE_MASK)
-
-#define FC_KIND(t, s)   (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))
-
-#define FC_SUBTYPE(fc)  (((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)
-#define FC_TYPE(fc) (((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)
-
-#define FC_ASSOC_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)
-#define FC_ASSOC_RESP   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)
-#define FC_REASSOC_REQ  FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)
-#define FC_REASSOC_RESP FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)
-#define FC_PROBE_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)
-#define FC_PROBE_RESP   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)
-#define FC_BEACON   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)
-#define FC_DISASSOC FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)
-#define FC_AUTH     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)
-#define FC_DEAUTH   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)
-#define FC_ACTION   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)
-#define FC_ACTION_NOACK FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)
-
-#define FC_CTL_WRAPPER  FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)
-#define FC_BLOCKACK_REQ FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)
-#define FC_BLOCKACK FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)
-#define FC_PS_POLL  FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)
-#define FC_RTS      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)
-#define FC_CTS      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)
-#define FC_ACK      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)
-#define FC_CF_END   FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)
-#define FC_CF_END_ACK   FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)
-
-#define FC_DATA     FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)
-#define FC_NULL_DATA    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)
-#define FC_DATA_CF_ACK  FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)
-#define FC_QOS_DATA FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)
-#define FC_QOS_NULL FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)
-
-
-
-
-#define QOS_PRIO_SHIFT      0
-#define QOS_PRIO_MASK       0x0007
-#define QOS_PRIO(qos)       (((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)
-
-
-#define QOS_TID_SHIFT       0
-#define QOS_TID_MASK        0x000f
-#define QOS_TID(qos)        (((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)
-
-
-#define QOS_EOSP_SHIFT      4
-#define QOS_EOSP_MASK       0x0010
-#define QOS_EOSP(qos)       (((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)
-
-
-#define QOS_ACK_NORMAL_ACK  0
-#define QOS_ACK_NO_ACK      1
-#define QOS_ACK_NO_EXP_ACK  2
-#define QOS_ACK_BLOCK_ACK   3
-#define QOS_ACK_SHIFT       5
-#define QOS_ACK_MASK        0x0060
-#define QOS_ACK(qos)        (((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)
-
-
-#define QOS_AMSDU_SHIFT     7
-#define QOS_AMSDU_MASK      0x0080
-
-
-
-
-
-
-#define DOT11_MNG_AUTH_ALGO_LEN     2
-#define DOT11_MNG_AUTH_SEQ_LEN      2
-#define DOT11_MNG_BEACON_INT_LEN    2
-#define DOT11_MNG_CAP_LEN       2
-#define DOT11_MNG_AP_ADDR_LEN       6
-#define DOT11_MNG_LISTEN_INT_LEN    2
-#define DOT11_MNG_REASON_LEN        2
-#define DOT11_MNG_AID_LEN       2
-#define DOT11_MNG_STATUS_LEN        2
-#define DOT11_MNG_TIMESTAMP_LEN     8
+#define DOT11_RC_TDLS_PEER_UNREACH	25
+#define DOT11_RC_TDLS_DOWN_UNSPECIFIED	26
 
+/* Status Codes */
+#define DOT11_SC_SUCCESS		0	/* Successful */
+#define DOT11_SC_FAILURE		1	/* Unspecified failure */
+#define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2	/* TDLS wakeup schedule rejected but alternative  */
+					/* schedule provided */
+#define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3	/* TDLS wakeup schedule rejected */
+#define DOT11_SC_TDLS_SEC_DISABLED	5	/* TDLS Security disabled */
+#define DOT11_SC_LIFETIME_REJ		6	/* Unacceptable lifetime */
+#define DOT11_SC_NOT_SAME_BSS		7	/* Not in same BSS */
+#define DOT11_SC_CAP_MISMATCH		10	/* Cannot support all requested
+						 * capabilities in the Capability
+						 * Information field
+						 */
+#define DOT11_SC_REASSOC_FAIL		11	/* Reassociation denied due to inability
+						 * to confirm that association exists
+						 */
+#define DOT11_SC_ASSOC_FAIL		12	/* Association denied due to reason
+						 * outside the scope of this standard
+						 */
+#define DOT11_SC_AUTH_MISMATCH		13	/* Responding station does not support
+						 * the specified authentication
+						 * algorithm
+						 */
+#define DOT11_SC_AUTH_SEQ		14	/* Received an Authentication frame
+						 * with authentication transaction
+						 * sequence number out of expected
+						 * sequence
+						 */
+#define DOT11_SC_AUTH_CHALLENGE_FAIL	15	/* Authentication rejected because of
+						 * challenge failure
+						 */
+#define DOT11_SC_AUTH_TIMEOUT		16	/* Authentication rejected due to timeout
+						 * waiting for next frame in sequence
+						 */
+#define DOT11_SC_ASSOC_BUSY_FAIL	17	/* Association denied because AP is
+						 * unable to handle additional
+						 * associated stations
+						 */
+#define DOT11_SC_ASSOC_RATE_MISMATCH	18	/* Association denied due to requesting
+						 * station not supporting all of the
+						 * data rates in the BSSBasicRateSet
+						 * parameter
+						 */
+#define DOT11_SC_ASSOC_SHORT_REQUIRED	19	/* Association denied due to requesting
+						 * station not supporting the Short
+						 * Preamble option
+						 */
+#define DOT11_SC_ASSOC_PBCC_REQUIRED	20	/* Association denied due to requesting
+						 * station not supporting the PBCC
+						 * Modulation option
+						 */
+#define DOT11_SC_ASSOC_AGILITY_REQUIRED	21	/* Association denied due to requesting
+						 * station not supporting the Channel
+						 * Agility option
+						 */
+#define DOT11_SC_ASSOC_SPECTRUM_REQUIRED	22	/* Association denied because Spectrum
+							 * Management capability is required.
+							 */
+#define DOT11_SC_ASSOC_BAD_POWER_CAP	23	/* Association denied because the info
+						 * in the Power Cap element is
+						 * unacceptable.
+						 */
+#define DOT11_SC_ASSOC_BAD_SUP_CHANNELS	24	/* Association denied because the info
+						 * in the Supported Channel element is
+						 * unacceptable
+						 */
+#define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED	25	/* Association denied due to requesting
+							 * station not supporting the Short Slot
+							 * Time option
+							 */
+#define DOT11_SC_ASSOC_ERPBCC_REQUIRED	26	/* Association denied due to requesting
+						 * station not supporting the ER-PBCC
+						 * Modulation option
+						 */
+#define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED	27	/* Association denied due to requesting
+						 * station not supporting the DSS-OFDM
+						 * option
+						 */
+#define DOT11_SC_ASSOC_R0KH_UNREACHABLE	28	/* Association denied due to AP
+						 * being unable to reach the R0 Key Holder
+						 */
+#define DOT11_SC_ASSOC_TRY_LATER	30	/* Association denied temporarily, try again later
+						 */
+#define DOT11_SC_ASSOC_MFP_VIOLATION	31	/* Association denied due to Robust Management
+						 * frame policy violation
+						 */
+#define DOT11_SC_ASSOC_HT_REQUIRED	32	/* Association denied because the requesting
+						 * station does not support HT features
+						 */
+
+#define	DOT11_SC_DECLINED		37	/* request declined */
+#define	DOT11_SC_INVALID_PARAMS		38	/* One or more params have invalid values */
+#define DOT11_SC_INVALID_PAIRWISE_CIPHER	42 /* invalid pairwise cipher */
+#define	DOT11_SC_INVALID_AKMP		43	/* Association denied due to invalid AKMP */
+#define DOT11_SC_INVALID_RSNIE_CAP	45	/* invalid RSN IE capabilities */
+#define DOT11_SC_DLS_NOT_ALLOWED	48	/* DLS is not allowed in the BSS by policy */
+#define	DOT11_SC_INVALID_PMKID		53	/* Association denied due to invalid PMKID */
+#define	DOT11_SC_INVALID_MDID		54	/* Association denied due to invalid MDID */
+#define	DOT11_SC_INVALID_FTIE		55	/* Association denied due to invalid FTIE */
+
+#define DOT11_SC_ADV_PROTO_NOT_SUPPORTED	59	/* ad proto not supported */
+#define DOT11_SC_NO_OUTSTAND_REQ			60	/* no outstanding req */
+#define DOT11_SC_RSP_NOT_RX_FROM_SERVER		61	/* no response from server */
+#define DOT11_SC_TIMEOUT					62	/* timeout */
+#define DOT11_SC_QUERY_RSP_TOO_LARGE		63	/* query rsp too large */
+#define DOT11_SC_SERVER_UNREACHABLE			65	/* server unreachable */
+
+#define DOT11_SC_UNEXP_MSG			70	/* Unexpected message */
+#define DOT11_SC_INVALID_SNONCE		71	/* Invalid SNonce */
+#define DOT11_SC_INVALID_RSNIE		72	/* Invalid contents of RSNIE */
+#define DOT11_SC_ASSOC_VHT_REQUIRED	104	/* Association denied because the requesting
+						 * station does not support VHT features.
+						 */
+
+#define DOT11_SC_TRANSMIT_FAILURE	79	/* transmission failure */
+
+/* Info Elts, length of INFORMATION portion of Info Elts */
+#define DOT11_MNG_DS_PARAM_LEN			1	/* d11 management DS parameter length */
+#define DOT11_MNG_IBSS_PARAM_LEN		2	/* d11 management IBSS parameter length */
+
+/* TIM Info element has 3 bytes fixed info in INFORMATION field,
+ * followed by 1 to 251 bytes of Partial Virtual Bitmap
+ */
+#define DOT11_MNG_TIM_FIXED_LEN			3	/* d11 management TIM fixed length */
+#define DOT11_MNG_TIM_DTIM_COUNT		0	/* d11 management DTIM count */
+#define DOT11_MNG_TIM_DTIM_PERIOD		1	/* d11 management DTIM period */
+#define DOT11_MNG_TIM_BITMAP_CTL		2	/* d11 management TIM BITMAP control  */
+#define DOT11_MNG_TIM_PVB			3	/* d11 management TIM PVB */
+
+/* TLV defines */
+#define TLV_TAG_OFF		0	/* tag offset */
+#define TLV_LEN_OFF		1	/* length offset */
+#define TLV_HDR_LEN		2	/* header length */
+#define TLV_BODY_OFF		2	/* body offset */
+
+/* Management Frame Information Element IDs */
+#define DOT11_MNG_SSID_ID			0	/* d11 management SSID id */
+#define DOT11_MNG_RATES_ID			1	/* d11 management rates id */
+#define DOT11_MNG_FH_PARMS_ID			2	/* d11 management FH parameter id */
+#define DOT11_MNG_DS_PARMS_ID			3	/* d11 management DS parameter id */
+#define DOT11_MNG_CF_PARMS_ID			4	/* d11 management CF parameter id */
+#define DOT11_MNG_TIM_ID			5	/* d11 management TIM id */
+#define DOT11_MNG_IBSS_PARMS_ID			6	/* d11 management IBSS parameter id */
+#define DOT11_MNG_COUNTRY_ID			7	/* d11 management country id */
+#define DOT11_MNG_HOPPING_PARMS_ID		8	/* d11 management hopping parameter id */
+#define DOT11_MNG_HOPPING_TABLE_ID		9	/* d11 management hopping table id */
+#define DOT11_MNG_REQUEST_ID			10	/* d11 management request id */
+#define DOT11_MNG_QBSS_LOAD_ID 			11	/* d11 management QBSS Load id */
+#define DOT11_MNG_EDCA_PARAM_ID			12	/* 11E EDCA Parameter id */
+#define DOT11_MNG_TSPEC_ID			13	/* d11 management TSPEC id */
+#define DOT11_MNG_TCLAS_ID			14	/* d11 management TCLAS id */
+#define DOT11_MNG_CHALLENGE_ID			16	/* d11 management chanllenge id */
+#define DOT11_MNG_PWR_CONSTRAINT_ID		32	/* 11H PowerConstraint */
+#define DOT11_MNG_PWR_CAP_ID			33	/* 11H PowerCapability */
+#define DOT11_MNG_TPC_REQUEST_ID 		34	/* 11H TPC Request */
+#define DOT11_MNG_TPC_REPORT_ID			35	/* 11H TPC Report */
+#define DOT11_MNG_SUPP_CHANNELS_ID		36	/* 11H Supported Channels */
+#define DOT11_MNG_CHANNEL_SWITCH_ID		37	/* 11H ChannelSwitch Announcement */
+#define DOT11_MNG_MEASURE_REQUEST_ID		38	/* 11H MeasurementRequest */
+#define DOT11_MNG_MEASURE_REPORT_ID		39	/* 11H MeasurementReport */
+#define DOT11_MNG_QUIET_ID			40	/* 11H Quiet */
+#define DOT11_MNG_IBSS_DFS_ID			41	/* 11H IBSS_DFS */
+#define DOT11_MNG_ERP_ID			42	/* d11 management ERP id */
+#define DOT11_MNG_TS_DELAY_ID			43	/* d11 management TS Delay id */
+#define DOT11_MNG_TCLAS_PROC_ID			44	/* d11 management TCLAS processing id */
+#define	DOT11_MNG_HT_CAP			45	/* d11 mgmt HT cap id */
+#define DOT11_MNG_QOS_CAP_ID			46	/* 11E QoS Capability id */
+#define DOT11_MNG_NONERP_ID			47	/* d11 management NON-ERP id */
+#define DOT11_MNG_RSN_ID			48	/* d11 management RSN id */
+#define DOT11_MNG_EXT_RATES_ID			50	/* d11 management ext. rates id */
+#define DOT11_MNG_AP_CHREP_ID			51	/* 11k AP Channel report id */
+#define DOT11_MNG_NEIGHBOR_REP_ID		52	/* 11k & 11v Neighbor report id */
+#define DOT11_MNG_RCPI_ID			53	/* 11k RCPI */
+#define DOT11_MNG_MDIE_ID			54	/* 11r Mobility domain id */
+#define DOT11_MNG_FTIE_ID			55	/* 11r Fast Bss Transition id */
+#define DOT11_MNG_FT_TI_ID			56	/* 11r Timeout Interval id */
+#define DOT11_MNG_RDE_ID			57	/* 11r RIC Data Element id */
+#define	DOT11_MNG_REGCLASS_ID			59	/* d11 management regulatory class id */
+#define DOT11_MNG_EXT_CSA_ID			60	/* d11 Extended CSA */
+#define	DOT11_MNG_HT_ADD			61	/* d11 mgmt additional HT info */
+#define	DOT11_MNG_EXT_CHANNEL_OFFSET		62	/* d11 mgmt ext channel offset */
+#define DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID	63	/* 11k bss average access delay */
+#define DOT11_MNG_ANTENNA_ID			64	/* 11k antenna id */
+#define DOT11_MNG_RSNI_ID			65	/* 11k RSNI id */
+#define DOT11_MNG_MEASUREMENT_PILOT_TX_ID	66	/* 11k measurement pilot tx info id */
+#define DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID	67	/* 11k bss aval admission cap id */
+#define DOT11_MNG_BSS_AC_ACCESS_DELAY_ID	68	/* 11k bss AC access delay id */
+#define DOT11_MNG_WAPI_ID			68	/* d11 management WAPI id */
+#define DOT11_MNG_TIME_ADVERTISE_ID	69	/* 11p time advertisement */
+#define DOT11_MNG_RRM_CAP_ID		70	/* 11k radio measurement capability */
+#define DOT11_MNG_MULTIPLE_BSSID_ID		71	/* 11k multiple BSSID id */
+#define	DOT11_MNG_HT_BSS_COEXINFO_ID		72	/* d11 mgmt OBSS Coexistence INFO */
+#define	DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID	73	/* d11 mgmt OBSS Intolerant Channel list */
+#define	DOT11_MNG_HT_OBSS_ID			74	/* d11 mgmt OBSS HT info */
+#define DOT11_MNG_MMIE_ID			76	/* d11 mgmt MIC IE */
+#define DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID	90	/* 11v bss max idle id */
+#define DOT11_MNG_TFS_REQUEST_ID		91	/* 11v tfs request id */
+#define DOT11_MNG_TFS_RESPONSE_ID		92	/* 11v tfs response id */
+#define DOT11_MNG_WNM_SLEEP_MODE_ID		93	/* 11v wnm-sleep mode id */
+#define DOT11_MNG_TIMBC_REQ_ID			94	/* 11v TIM broadcast request id */
+#define DOT11_MNG_TIMBC_RESP_ID			95	/* 11v TIM broadcast response id */
+#define DOT11_MNG_CHANNEL_USAGE			97	/* 11v channel usage */
+#define DOT11_MNG_TIME_ZONE_ID			98	/* 11v time zone */
+#define DOT11_MNG_DMS_REQUEST_ID		99	/* 11v dms request id */
+#define DOT11_MNG_DMS_RESPONSE_ID		100	/* 11v dms response id */
+#define DOT11_MNG_LINK_IDENTIFIER_ID		101	/* 11z TDLS Link Identifier IE */
+#define DOT11_MNG_WAKEUP_SCHEDULE_ID		102	/* 11z TDLS Wakeup Schedule IE */
+#define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID	104	/* 11z TDLS Channel Switch Timing IE */
+#define DOT11_MNG_PTI_CONTROL_ID		105	/* 11z TDLS PTI Control IE */
+#define DOT11_MNG_PU_BUFFER_STATUS_ID	106	/* 11z TDLS PU Buffer Status IE */
+#define DOT11_MNG_INTERWORKING_ID		107	/* 11u interworking */
+#define DOT11_MNG_ADVERTISEMENT_ID		108	/* 11u advertisement protocol */
+#define DOT11_MNG_EXP_BW_REQ_ID			109	/* 11u expedited bandwith request */
+#define DOT11_MNG_QOS_MAP_ID			110	/* 11u QoS map set */
+#define DOT11_MNG_ROAM_CONSORT_ID		111	/* 11u roaming consortium */
+#define DOT11_MNG_EMERGCY_ALERT_ID		112	/* 11u emergency alert identifier */
+#define	DOT11_MNG_EXT_CAP_ID			127	/* d11 mgmt ext capability */
+#define	DOT11_MNG_VHT_CAP_ID			191	/* d11 mgmt VHT cap id */
+#define	DOT11_MNG_VHT_OPERATION_ID		192	/* d11 mgmt VHT op id */
+#define DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID		194	/* Wide BW Channel Switch IE */
+#define DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID	195	/* VHT transmit Power Envelope IE */
+#define DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID		196	/* Channel Switch Wrapper IE */
+#define DOT11_MNG_AID_ID					197	/* Association ID  IE */
+#define	DOT11_MNG_OPER_MODE_NOTIF_ID	199	/* d11 mgmt VHT oper mode notif */
+
+
+#define DOT11_MNG_WPA_ID			221	/* d11 management WPA id */
+#define DOT11_MNG_PROPR_ID			221	/* d11 management proprietary id */
+/* should start using this one instead of above two */
+#define DOT11_MNG_VS_ID				221	/* d11 management Vendor Specific IE */
+
+/* Rate Defines */
+
+/* Valid rates for the Supported Rates and Extended Supported Rates IEs.
+ * Encoding is the rate in 500kbps units, rouding up for fractional values.
+ * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
+ * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
+ * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
+ * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices.
+ */
 
-#define DOT11_AID_MASK          0x3fff
+#define DOT11_RATE_1M   2       /* 1  Mbps in 500kbps units */
+#define DOT11_RATE_2M   4       /* 2  Mbps in 500kbps units */
+#define DOT11_RATE_5M5  11      /* 5.5 Mbps in 500kbps units */
+#define DOT11_RATE_11M  22      /* 11 Mbps in 500kbps units */
+#define DOT11_RATE_6M   12      /* 6  Mbps in 500kbps units */
+#define DOT11_RATE_9M   18      /* 9  Mbps in 500kbps units */
+#define DOT11_RATE_12M  24      /* 12 Mbps in 500kbps units */
+#define DOT11_RATE_18M  36      /* 18 Mbps in 500kbps units */
+#define DOT11_RATE_24M  48      /* 24 Mbps in 500kbps units */
+#define DOT11_RATE_36M  72      /* 36 Mbps in 500kbps units */
+#define DOT11_RATE_48M  96      /* 48 Mbps in 500kbps units */
+#define DOT11_RATE_54M  108     /* 54 Mbps in 500kbps units */
+#define DOT11_RATE_MAX  108     /* highest rate (54 Mbps) in 500kbps units */
+
+/* Supported Rates and Extended Supported Rates IEs
+ * The supported rates octets are defined a the MSB indicatin a Basic Rate
+ * and bits 0-6 as the rate value
+ */
+#define DOT11_RATE_BASIC                0x80 /* flag for a Basic Rate */
+#define DOT11_RATE_MASK                 0x7F /* mask for numeric part of rate */
+
+/* BSS Membership Selector parameters
+ * 802.11-2012 and 802.11ac_D4.0 sec 8.4.2.3
+ * These selector values are advertised in Supported Rates and Extended Supported Rates IEs
+ * in the supported rates list with the Basic rate bit set.
+ * Constants below include the basic bit.
+ */
+#define DOT11_BSS_MEMBERSHIP_HT         0xFF  /* Basic 0x80 + 127, HT Required to join */
+#define DOT11_BSS_MEMBERSHIP_VHT        0xFE  /* Basic 0x80 + 126, VHT Required to join */
+
+/* ERP info element bit values */
+#define DOT11_MNG_ERP_LEN			1	/* ERP is currently 1 byte long */
+#define DOT11_MNG_NONERP_PRESENT		0x01	/* NonERP (802.11b) STAs are present
+							 *in the BSS
+							 */
+#define DOT11_MNG_USE_PROTECTION		0x02	/* Use protection mechanisms for
+							 *ERP-OFDM frames
+							 */
+#define DOT11_MNG_BARKER_PREAMBLE		0x04	/* Short Preambles: 0 == allowed,
+							 * 1 == not allowed
+							 */
+/* TS Delay element offset & size */
+#define DOT11_MGN_TS_DELAY_LEN		4	/* length of TS DELAY IE */
+#define TS_DELAY_FIELD_SIZE			4	/* TS DELAY field size */
+
+/* Capability Information Field */
+#define DOT11_CAP_ESS				0x0001	/* d11 cap. ESS */
+#define DOT11_CAP_IBSS				0x0002	/* d11 cap. IBSS */
+#define DOT11_CAP_POLLABLE			0x0004	/* d11 cap. pollable */
+#define DOT11_CAP_POLL_RQ			0x0008	/* d11 cap. poll request */
+#define DOT11_CAP_PRIVACY			0x0010	/* d11 cap. privacy */
+#define DOT11_CAP_SHORT				0x0020	/* d11 cap. short */
+#define DOT11_CAP_PBCC				0x0040	/* d11 cap. PBCC */
+#define DOT11_CAP_AGILITY			0x0080	/* d11 cap. agility */
+#define DOT11_CAP_SPECTRUM			0x0100	/* d11 cap. spectrum */
+#define DOT11_CAP_QOS				0x0200	/* d11 cap. qos */
+#define DOT11_CAP_SHORTSLOT			0x0400	/* d11 cap. shortslot */
+#define DOT11_CAP_APSD				0x0800	/* d11 cap. apsd */
+#define DOT11_CAP_RRM				0x1000	/* d11 cap. 11k radio measurement */
+#define DOT11_CAP_CCK_OFDM			0x2000	/* d11 cap. CCK/OFDM */
+#define DOT11_CAP_DELAY_BA			0x4000	/* d11 cap. delayed block ack */
+#define DOT11_CAP_IMMEDIATE_BA			0x8000	/* d11 cap. immediate block ack */
+
+/* Extended capabilities IE bitfields */
+/* 20/40 BSS Coexistence Management support bit position */
+#define DOT11_EXT_CAP_OBSS_COEX_MGMT		0
+/* scheduled PSMP support bit position */
+#define DOT11_EXT_CAP_SPSMP			6
+/*  Flexible Multicast Service */
+#define DOT11_EXT_CAP_FMS			11
+/* proxy ARP service support bit position */
+#define DOT11_EXT_CAP_PROXY_ARP			12
+/* Traffic Filter Service */
+#define DOT11_EXT_CAP_TFS			16
+/* WNM-Sleep Mode */
+#define DOT11_EXT_CAP_WNM_SLEEP			17
+/* TIM Broadcast service */
+#define DOT11_EXT_CAP_TIMBC			18
+/* BSS Transition Management support bit position */
+#define DOT11_EXT_CAP_BSSTRANS_MGMT		19
+/* Direct Multicast Service */
+#define DOT11_EXT_CAP_DMS			26
+/* Interworking support bit position */
+#define DOT11_EXT_CAP_IW			31
+/* service Interval granularity bit position and mask */
+#define DOT11_EXT_CAP_SI			41
+#define DOT11_EXT_CAP_SI_MASK			0x0E
+/* WNM notification */
+#define DOT11_EXT_CAP_WNM_NOTIF			46
+/* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
+#define DOT11_EXT_CAP_OPER_MODE_NOTIF		62
+
+/* VHT Operating mode bit fields -  (11ac D3.0 - 8.4.1.50) */
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
+#define DOT11_OPER_MODE_RXNSS_SHIFT 4
+#define DOT11_OPER_MODE_RXNSS_MASK 0x70
+#define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
+#define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
+
+#define DOT11_OPER_MODE(type, nss, chanw) (\
+	((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
+		 DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
+	(((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
+	((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
+		 DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH(mode) \
+	(((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK)\
+		>> DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
+#define DOT11_OPER_MODE_RXNSS(mode) \
+	((((mode) & DOT11_OPER_MODE_RXNSS_MASK)		\
+		>> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
+#define DOT11_OPER_MODE_RXNSS_TYPE(mode) \
+	(((mode) & DOT11_OPER_MODE_RXNSS_TYPE_MASK)\
+		>> DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
+
+#define DOT11_OPER_MODE_20MHZ 0
+#define DOT11_OPER_MODE_40MHZ 1
+#define DOT11_OPER_MODE_80MHZ 2
+#define DOT11_OPER_MODE_160MHZ 3
+#define DOT11_OPER_MODE_8080MHZ 3
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_160MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_8080MHZ)
+
+/* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
+BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
+	uint8 mode;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
 
+#define DOT11_OPER_MODE_NOTIF_IE_LEN 1
 
-#define DOT11_RC_RESERVED       0
-#define DOT11_RC_UNSPECIFIED        1
-#define DOT11_RC_AUTH_INVAL     2
-#define DOT11_RC_DEAUTH_LEAVING     3
-#define DOT11_RC_INACTIVITY     4
-#define DOT11_RC_BUSY           5
-#define DOT11_RC_INVAL_CLASS_2      6
-#define DOT11_RC_INVAL_CLASS_3      7
-#define DOT11_RC_DISASSOC_LEAVING   8
-#define DOT11_RC_NOT_AUTH       9
-#define DOT11_RC_BAD_PC         10
-#define DOT11_RC_BAD_CHANNELS       11
+/* Extended Capability Information Field */
+#define DOT11_OBSS_COEX_MNG_SUPPORT	0x01	/* 20/40 BSS Coexistence Management support */
 
+/*
+ * Action Frame Constants
+ */
+#define DOT11_ACTION_HDR_LEN		2	/* action frame category + action field */
+#define DOT11_ACTION_CAT_OFF		0	/* category offset */
+#define DOT11_ACTION_ACT_OFF		1	/* action offset */
+
+/* Action Category field (sec 8.4.1.11) */
+#define DOT11_ACTION_CAT_ERR_MASK	0x80	/* category error mask */
+#define DOT11_ACTION_CAT_MASK		0x7F	/* category mask */
+#define DOT11_ACTION_CAT_SPECT_MNG	0	/* category spectrum management */
+#define DOT11_ACTION_CAT_QOS		1	/* category QoS */
+#define DOT11_ACTION_CAT_DLS		2	/* category DLS */
+#define DOT11_ACTION_CAT_BLOCKACK	3	/* category block ack */
+#define DOT11_ACTION_CAT_PUBLIC		4	/* category public */
+#define DOT11_ACTION_CAT_RRM		5	/* category radio measurements */
+#define DOT11_ACTION_CAT_FBT	6	/* category fast bss transition */
+#define DOT11_ACTION_CAT_HT		7	/* category for HT */
+#define	DOT11_ACTION_CAT_SA_QUERY	8	/* security association query */
+#define	DOT11_ACTION_CAT_PDPA		9	/* protected dual of public action */
+#define DOT11_ACTION_CAT_WNM		10	/* category for WNM */
+#define DOT11_ACTION_CAT_UWNM		11	/* category for Unprotected WNM */
+#define DOT11_ACTION_NOTIFICATION	17
+#define DOT11_ACTION_CAT_VHT		21	/* VHT action */
+#define DOT11_ACTION_CAT_VSP		126	/* protected vendor specific */
+#define DOT11_ACTION_CAT_VS		127	/* category Vendor Specific */
+
+/* Spectrum Management Action IDs (sec 7.4.1) */
+#define DOT11_SM_ACTION_M_REQ		0	/* d11 action measurement request */
+#define DOT11_SM_ACTION_M_REP		1	/* d11 action measurement response */
+#define DOT11_SM_ACTION_TPC_REQ		2	/* d11 action TPC request */
+#define DOT11_SM_ACTION_TPC_REP		3	/* d11 action TPC response */
+#define DOT11_SM_ACTION_CHANNEL_SWITCH	4	/* d11 action channel switch */
+#define DOT11_SM_ACTION_EXT_CSA		5	/* d11 extened CSA for 11n */
+
+/* HT action ids */
+#define DOT11_ACTION_ID_HT_CH_WIDTH	0	/* notify channel width action id */
+#define DOT11_ACTION_ID_HT_MIMO_PS	1	/* mimo ps action id */
+
+/* Public action ids */
+#define DOT11_PUB_ACTION_BSS_COEX_MNG	0	/* 20/40 Coexistence Management action id */
+#define DOT11_PUB_ACTION_CHANNEL_SWITCH	4	/* d11 action channel switch */
+
+/* Block Ack action types */
+#define DOT11_BA_ACTION_ADDBA_REQ	0	/* ADDBA Req action frame type */
+#define DOT11_BA_ACTION_ADDBA_RESP	1	/* ADDBA Resp action frame type */
+#define DOT11_BA_ACTION_DELBA		2	/* DELBA action frame type */
+
+/* ADDBA action parameters */
+#define DOT11_ADDBA_PARAM_AMSDU_SUP	0x0001	/* AMSDU supported under BA */
+#define DOT11_ADDBA_PARAM_POLICY_MASK	0x0002	/* policy mask(ack vs delayed) */
+#define DOT11_ADDBA_PARAM_POLICY_SHIFT	1	/* policy shift */
+#define DOT11_ADDBA_PARAM_TID_MASK	0x003c	/* tid mask */
+#define DOT11_ADDBA_PARAM_TID_SHIFT	2	/* tid shift */
+#define DOT11_ADDBA_PARAM_BSIZE_MASK	0xffc0	/* buffer size mask */
+#define DOT11_ADDBA_PARAM_BSIZE_SHIFT	6	/* buffer size shift */
+
+#define DOT11_ADDBA_POLICY_DELAYED	0	/* delayed BA policy */
+#define DOT11_ADDBA_POLICY_IMMEDIATE	1	/* immediate BA policy */
+
+/* Fast Transition action types */
+#define DOT11_FT_ACTION_FT_RESERVED		0
+#define DOT11_FT_ACTION_FT_REQ			1	/* FBT request - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_RES			2	/* FBT response - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_CON			3	/* FBT confirm - for OTDS with RRP */
+#define DOT11_FT_ACTION_FT_ACK			4	/* FBT ack */
+
+/* DLS action types */
+#define DOT11_DLS_ACTION_REQ			0	/* DLS Request */
+#define DOT11_DLS_ACTION_RESP			1	/* DLS Response */
+#define DOT11_DLS_ACTION_TD			2	/* DLS Teardown */
+
+/* Wireless Network Management (WNM) action types */
+#define DOT11_WNM_ACTION_EVENT_REQ		0
+#define DOT11_WNM_ACTION_EVENT_REP		1
+#define DOT11_WNM_ACTION_DIAG_REQ		2
+#define DOT11_WNM_ACTION_DIAG_REP		3
+#define DOT11_WNM_ACTION_LOC_CFG_REQ		4
+#define DOT11_WNM_ACTION_LOC_RFG_RESP		5
+#define DOT11_WNM_ACTION_BSSTRANS_QUERY		6
+#define DOT11_WNM_ACTION_BSSTRANS_REQ		7
+#define DOT11_WNM_ACTION_BSSTRANS_RESP		8
+#define DOT11_WNM_ACTION_FMS_REQ		9
+#define DOT11_WNM_ACTION_FMS_RESP		10
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ	11
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REP	12
+#define DOT11_WNM_ACTION_TFS_REQ		13
+#define DOT11_WNM_ACTION_TFS_RESP		14
+#define DOT11_WNM_ACTION_TFS_NOTIFY		15
+#define DOT11_WNM_ACTION_WNM_SLEEP_REQ		16
+#define DOT11_WNM_ACTION_WNM_SLEEP_RESP		17
+#define DOT11_WNM_ACTION_TIMBC_REQ		18
+#define DOT11_WNM_ACTION_TIMBC_RESP		19
+#define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD	20
+#define DOT11_WNM_ACTION_CHAN_USAGE_REQ		21
+#define DOT11_WNM_ACTION_CHAN_USAGE_RESP	22
+#define DOT11_WNM_ACTION_DMS_REQ		23
+#define DOT11_WNM_ACTION_DMS_RESP		24
+#define DOT11_WNM_ACTION_TMNG_MEASUR_REQ	25
+#define DOT11_WNM_ACTION_NOTFCTN_REQ		26
+#define DOT11_WNM_ACTION_NOTFCTN_RESP		27
+
+/* Unprotected Wireless Network Management (WNM) action types */
+#define DOT11_UWNM_ACTION_TIM			0
+#define DOT11_UWNM_ACTION_TIMING_MEASUREMENT	1
+
+#define DOT11_MNG_COUNTRY_ID_LEN 3
+
+/* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
+#define DOT11_VHT_ACTION_CBF				0	/* Compressed Beamforming */
+#define DOT11_VHT_ACTION_GID_MGMT			1	/* Group ID Management */
+#define DOT11_VHT_ACTION_OPER_MODE_NOTIF	2	/* Operating mode notif'n */
+
+/* DLS Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
+	uint8 category;			/* category of action frame (2) */
+	uint8 action;				/* DLS action: req (0) */
+	struct ether_addr	da;		/* destination address */
+	struct ether_addr	sa;		/* source address */
+	uint16 cap;				/* capability */
+	uint16 timeout;			/* timeout value */
+	uint8 data[1];				/* IE:support rate, extend support rate, HT cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_req dot11_dls_req_t;
+#define DOT11_DLS_REQ_LEN 18	/* Fixed length */
+
+/* DLS response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
+	uint8 category;			/* category of action frame (2) */
+	uint8 action;				/* DLS action: req (0) */
+	uint16 status;				/* status code field */
+	struct ether_addr	da;		/* destination address */
+	struct ether_addr	sa;		/* source address */
+	uint8 data[1];				/* optional: capability, rate ... */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_resp dot11_dls_resp_t;
+#define DOT11_DLS_RESP_LEN 16	/* Fixed length */
+
+
+/* ************* 802.11v related definitions. ************* */
+
+/* BSS Management Transition Query frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* WNM action: trans_query (6) */
+	uint8 token;			/* dialog token */
+	uint8 reason;			/* transition query reason */
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
+#define DOT11_BSSTRANS_QUERY_LEN 4	/* Fixed length */
+
+/* BSS Management Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* WNM action: trans_req (7) */
+	uint8 token;			/* dialog token */
+	uint8 reqmode;			/* transition request mode */
+	uint16 disassoc_tmr;		/* disassociation timer */
+	uint8 validity_intrvl;		/* validity interval */
+	uint8 data[1];			/* optional: BSS term duration, ... */
+						/* ...session info URL, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
+#define DOT11_BSSTRANS_REQ_LEN 7	/* Fixed length */
+
+/* BSS Mgmt Transition Request Mode Field - 802.11v */
+#define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL		0x01
+#define DOT11_BSSTRANS_REQMODE_ABRIDGED			0x02
+#define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT	0x04
+#define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL		0x08
+#define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT	0x10
+
+/* BSS Management transition response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* WNM action: trans_resp (8) */
+	uint8 token;			/* dialog token */
+	uint8 status;			/* transition status */
+	uint8 term_delay;		/* validity interval */
+	uint8 data[1];			/* optional: BSSID target, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
+#define DOT11_BSSTRANS_RESP_LEN 5	/* Fixed length */
+
+/* BSS Mgmt Transition Response Status Field */
+#define DOT11_BSSTRANS_RESP_STATUS_ACCEPT			0
+#define DOT11_BSSTRANS_RESP_STATUS_REJECT			1
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN		2
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP		3
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED		4
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ		5
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED	6
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS		7
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS		8
+
+
+/* BSS Max Idle Period information element */
+BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
+	uint8 id;				/* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
+	uint8 len;
+	uint16 max_idle_period;			/* in unit of 1000 TUs */
+	uint8 idle_opt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
+#define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN	3	/* bss max idle period IE size */
+#define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED	1	/* BSS max idle option */
 
+/* TIM Broadcast request information element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
+	uint8 id;				/* 94, DOT11_MNG_TIMBC_REQ_ID */
+	uint8 len;
+	uint8 interval;				/* in unit of beacon interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
+#define DOT11_TIMBC_REQ_IE_LEN		1	/* Fixed length */
 
-#define DOT11_RC_UNSPECIFIED_QOS    32
-#define DOT11_RC_INSUFFCIENT_BW     33
-#define DOT11_RC_EXCESSIVE_FRAMES   34
-#define DOT11_RC_TX_OUTSIDE_TXOP    35
-#define DOT11_RC_LEAVING_QBSS       36
-#define DOT11_RC_BAD_MECHANISM      37
-#define DOT11_RC_SETUP_NEEDED       38
-#define DOT11_RC_TIMEOUT        39
+/* TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* TIM broadcast request element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req dot11_timbc_req_t;
+#define DOT11_TIMBC_REQ_LEN		3	/* Fixed length */
 
-#define DOT11_RC_MAX            23
+/* TIM Broadcast response information element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
+	uint8 id;				/* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
+	uint8 len;
+	uint8 status;				/* status of add request */
+	uint8 interval;				/* in unit of beacon interval */
+	int32 offset;				/* in unit of ms */
+	uint16 high_rate;			/* in unit of 0.5 Mb/s */
+	uint16 low_rate;			/* in unit of 0.5 Mb/s */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
+#define DOT11_TIMBC_DENY_RESP_IE_LEN	1	/* Deny. Fixed length */
+#define DOT11_TIMBC_ACCEPT_RESP_IE_LEN	10	/* Accept. Fixed length */
+
+#define DOT11_TIMBC_STATUS_ACCEPT		0
+#define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP	1
+#define DOT11_TIMBC_STATUS_DENY			2
+#define DOT11_TIMBC_STATUS_OVERRIDDEN		3
+
+/* TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
+	uint8 token;			/* dialog token */
+	uint8 data[1];			/* TIM broadcast response element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp dot11_timbc_resp_t;
+#define DOT11_TIMBC_RESP_LEN	3	/* Fixed length */
+
+/* TIM element */
+BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
+	uint8 id;			/* 5, DOT11_MNG_TIM_ID	 */
+	uint8 len;			/* 4 - 255 */
+	uint8 dtim_count;		/* DTIM decrementing counter */
+	uint8 dtim_period;		/* DTIM period */
+	uint8 bitmap_control;	/* AID 0 + bitmap offset */
+	uint8 pvb[1];		/* Partial Virtual Bitmap, variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tim_ie dot11_tim_ie_t;
+#define DOT11_TIM_IE_FIXED_LEN	3	/* Fixed length, without id and len */
+#define DOT11_TIM_IE_FIXED_TOTAL_LEN	5	/* Fixed length, with id and len */
+
+/* TIM Broadcast frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc {
+	uint8 category;			/* category of action frame (11) */
+	uint8 action;			/* action: TIM (0) */
+	uint8 check_beacon;		/* need to check-beacon */
+	uint8 tsf[8];			/* Time Synchronization Function */
+	dot11_tim_ie_t tim_ie;		/* TIM element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc dot11_timbc_t;
+#define DOT11_TIMBC_HDR_LEN	(sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
+#define DOT11_TIMBC_FIXED_LEN	(sizeof(dot11_timbc_t) - 1)	/* Fixed length */
+#define DOT11_TIMBC_LEN			11	/* Fixed length */
+
+/* TCLAS frame classifier type */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
+	uint8 type;
+	uint8 mask;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
+#define DOT11_TCLAS_FC_HDR_LEN		2	/* Fixed length */
+
+#define DOT11_TCLAS_MASK_0		0x1
+#define DOT11_TCLAS_MASK_1		0x2
+#define DOT11_TCLAS_MASK_2		0x4
+#define DOT11_TCLAS_MASK_3		0x8
+#define DOT11_TCLAS_MASK_4		0x10
+#define DOT11_TCLAS_MASK_5		0x20
+#define DOT11_TCLAS_MASK_6		0x40
+#define DOT11_TCLAS_MASK_7		0x80
+
+#define DOT11_TCLAS_FC_0_ETH		0
+#define DOT11_TCLAS_FC_1_IP		1
+#define DOT11_TCLAS_FC_2_8021Q		2
+#define DOT11_TCLAS_FC_3_OFFSET		3
+#define DOT11_TCLAS_FC_4_IP_HIGHER	4
+#define DOT11_TCLAS_FC_5_8021D		5
+
+/* TCLAS frame classifier type 0 parameters for Ethernet */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
+	uint8 type;
+	uint8 mask;
+	uint8 sa[ETHER_ADDR_LEN];
+	uint8 da[ETHER_ADDR_LEN];
+	uint16 eth_type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
+#define DOT11_TCLAS_FC_0_ETH_LEN	16
 
-#define DOT11_RC_TDLS_PEER_UNREACH	25
-#define DOT11_RC_TDLS_DOWN_UNSPECIFIED	26
+/* TCLAS frame classifier type 1 parameters for IPV4 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
+	uint8 type;
+	uint8 mask;
+	uint8 version;
+	uint32 src_ip;
+	uint32 dst_ip;
+	uint16 src_port;
+	uint16 dst_port;
+	uint8 dscp;
+	uint8 protocol;
+	uint8 reserved;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
+#define DOT11_TCLAS_FC_1_IPV4_LEN	18
+
+/* TCLAS frame classifier type 2 parameters for 802.1Q */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
+	uint8 type;
+	uint8 mask;
+	uint16 tci;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
+#define DOT11_TCLAS_FC_2_8021Q_LEN	4
 
+/* TCLAS frame classifier type 3 parameters for filter offset */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
+	uint8 type;
+	uint8 mask;
+	uint16 offset;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
+#define DOT11_TCLAS_FC_3_FILTER_LEN	4
 
-#define DOT11_SC_SUCCESS		0	
-#define DOT11_SC_FAILURE		1	
-#define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2	
-					
-#define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3	
-#define DOT11_SC_TDLS_SEC_DISABLED	5	
-#define DOT11_SC_LIFETIME_REJ		6	
-#define DOT11_SC_NOT_SAME_BSS		7	
-#define DOT11_SC_CAP_MISMATCH       10
-#define DOT11_SC_REASSOC_FAIL       11
-#define DOT11_SC_ASSOC_FAIL     12
-#define DOT11_SC_AUTH_MISMATCH      13
-#define DOT11_SC_AUTH_SEQ       14
-#define DOT11_SC_AUTH_CHALLENGE_FAIL    15
-#define DOT11_SC_AUTH_TIMEOUT       16
-#define DOT11_SC_ASSOC_BUSY_FAIL    17
-#define DOT11_SC_ASSOC_RATE_MISMATCH    18
-#define DOT11_SC_ASSOC_SHORT_REQUIRED   19
-#define DOT11_SC_ASSOC_PBCC_REQUIRED    20
-#define DOT11_SC_ASSOC_AGILITY_REQUIRED 21
-#define DOT11_SC_ASSOC_SPECTRUM_REQUIRED    22
-#define DOT11_SC_ASSOC_BAD_POWER_CAP    23
-#define DOT11_SC_ASSOC_BAD_SUP_CHANNELS 24
-#define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED   25
-#define DOT11_SC_ASSOC_ERPBCC_REQUIRED  26
-#define DOT11_SC_ASSOC_DSSOFDM_REQUIRED 27
-#define DOT11_SC_ASSOC_R0KH_UNREACHABLE	28	
-#define DOT11_SC_ASSOC_TRY_LATER	30	
-#define DOT11_SC_ASSOC_MFP_VIOLATION	31	
-
-#define	DOT11_SC_DECLINED		37	
-#define	DOT11_SC_INVALID_PARAMS		38	
-#define DOT11_SC_INVALID_PAIRWISE_CIPHER	42 
-#define	DOT11_SC_INVALID_AKMP		43	
-#define DOT11_SC_INVALID_RSNIE_CAP	45	
-#define DOT11_SC_DLS_NOT_ALLOWED	48	
-#define	DOT11_SC_INVALID_PMKID		53	
-#define	DOT11_SC_INVALID_MDID		54	
-#define	DOT11_SC_INVALID_FTIE		55	
-
-#define DOT11_SC_UNEXP_MSG			70	
-#define DOT11_SC_INVALID_SNONCE		71	
-#define DOT11_SC_INVALID_RSNIE		72	
-
-
-#define DOT11_MNG_DS_PARAM_LEN          1
-#define DOT11_MNG_IBSS_PARAM_LEN        2
-
-
-#define DOT11_MNG_TIM_FIXED_LEN         3
-#define DOT11_MNG_TIM_DTIM_COUNT        0
-#define DOT11_MNG_TIM_DTIM_PERIOD       1
-#define DOT11_MNG_TIM_BITMAP_CTL        2
-#define DOT11_MNG_TIM_PVB           3
-
-
-#define TLV_TAG_OFF     0
-#define TLV_LEN_OFF     1
-#define TLV_HDR_LEN     2
-#define TLV_BODY_OFF        2
-
-
-#define DOT11_MNG_SSID_ID           0
-#define DOT11_MNG_RATES_ID          1
-#define DOT11_MNG_FH_PARMS_ID           2
-#define DOT11_MNG_DS_PARMS_ID           3
-#define DOT11_MNG_CF_PARMS_ID           4
-#define DOT11_MNG_TIM_ID            5
-#define DOT11_MNG_IBSS_PARMS_ID         6
-#define DOT11_MNG_COUNTRY_ID            7
-#define DOT11_MNG_HOPPING_PARMS_ID      8
-#define DOT11_MNG_HOPPING_TABLE_ID      9
-#define DOT11_MNG_REQUEST_ID            10
-#define DOT11_MNG_QBSS_LOAD_ID          11
-#define DOT11_MNG_EDCA_PARAM_ID         12
-#define DOT11_MNG_CHALLENGE_ID          16
-#define DOT11_MNG_PWR_CONSTRAINT_ID     32
-#define DOT11_MNG_PWR_CAP_ID            33
-#define DOT11_MNG_TPC_REQUEST_ID        34
-#define DOT11_MNG_TPC_REPORT_ID         35
-#define DOT11_MNG_SUPP_CHANNELS_ID      36
-#define DOT11_MNG_CHANNEL_SWITCH_ID     37
-#define DOT11_MNG_MEASURE_REQUEST_ID        38
-#define DOT11_MNG_MEASURE_REPORT_ID     39
-#define DOT11_MNG_QUIET_ID          40
-#define DOT11_MNG_IBSS_DFS_ID           41
-#define DOT11_MNG_ERP_ID            42
-#define DOT11_MNG_TS_DELAY_ID           43
-#define DOT11_MNG_HT_CAP            45
-#define DOT11_MNG_QOS_CAP_ID            46
-#define DOT11_MNG_NONERP_ID         47
-#define DOT11_MNG_RSN_ID            48
-#define DOT11_MNG_EXT_RATES_ID          50
-#define DOT11_MNG_AP_CHREP_ID       51
-#define DOT11_MNG_NBR_REP_ID        52
-#define DOT11_MNG_MDIE_ID       54
-#define DOT11_MNG_FTIE_ID       55
-#define DOT11_MNG_FT_TI_ID      56
-#define DOT11_MNG_REGCLASS_ID           59
-#define DOT11_MNG_EXT_CSA_ID            60
-#define DOT11_MNG_HT_ADD            61
-#define DOT11_MNG_EXT_CHANNEL_OFFSET        62
-#define DOT11_MNG_WAPI_ID			68	
-#define DOT11_MNG_TIME_ADVERTISE_ID	69	
-#define DOT11_MNG_RRM_CAP_ID		70	
-#define	DOT11_MNG_HT_BSS_COEXINFO_ID		72	
-#define	DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID	73	
-#define	DOT11_MNG_HT_OBSS_ID			74	
-#define DOT11_MNG_CHANNEL_USAGE			97 
-#define DOT11_MNG_TIME_ZONE_ID			98	
-#define DOT11_MNG_LINK_IDENTIFIER_ID	101	
-#define DOT11_MNG_WAKEUP_SCHEDULE_ID	102 
-#define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID	104 
-#define DOT11_MNG_PTI_CONTROL_ID		105	
-#define DOT11_MNG_PU_BUFFER_STATUS_ID	106	
-#define DOT11_MNG_INTERWORKING_ID		107	
-#define DOT11_MNG_ADVERTISEMENT_ID		108	
-#define DOT11_MNG_EXP_BW_REQ_ID			109	
-#define DOT11_MNG_QOS_MAP_ID			110	
-#define DOT11_MNG_ROAM_CONSORT_ID		111	
-#define DOT11_MNG_EMERGCY_ALERT_ID		112	
-#define	DOT11_MNG_EXT_CAP_ID		127	
-#define	DOT11_MNG_VHT_CAP_ID		191	
-#define	DOT11_MNG_VHT_OPERATION_ID	192	
-#define DOT11_MNG_WPA_ID            221
-#define DOT11_MNG_PROPR_ID          221
-
-#define DOT11_MNG_VS_ID             221
-
-
-#define DOT11_RATE_BASIC            0x80
-#define DOT11_RATE_MASK             0x7F
-
-
-#define DOT11_MNG_ERP_LEN           1
-#define DOT11_MNG_NONERP_PRESENT        0x01
-#define DOT11_MNG_USE_PROTECTION        0x02
-#define DOT11_MNG_BARKER_PREAMBLE       0x04
-
-#define DOT11_MGN_TS_DELAY_LEN      4
-#define TS_DELAY_FIELD_SIZE         4
-
-
-#define DOT11_CAP_ESS               0x0001
-#define DOT11_CAP_IBSS              0x0002
-#define DOT11_CAP_POLLABLE          0x0004
-#define DOT11_CAP_POLL_RQ           0x0008
-#define DOT11_CAP_PRIVACY           0x0010
-#define DOT11_CAP_SHORT             0x0020
-#define DOT11_CAP_PBCC              0x0040
-#define DOT11_CAP_AGILITY           0x0080
-#define DOT11_CAP_SPECTRUM          0x0100
-#define DOT11_CAP_SHORTSLOT         0x0400
-#define DOT11_CAP_RRM           0x1000
-#define DOT11_CAP_CCK_OFDM          0x2000
+/* TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type 1 */
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
+#define DOT11_TCLAS_FC_4_IPV4_LEN	DOT11_TCLAS_FC_1_IPV4_LEN
 
+/* TCLAS frame classifier type 4 parameters for IPV6 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
+	uint8 type;
+	uint8 mask;
+	uint8 version;
+	uint8 saddr[16];
+	uint8 daddr[16];
+	uint16 src_port;
+	uint16 dst_port;
+	uint8 dscp;
+	uint8 nexthdr;
+	uint8 flow_lbl[3];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
+#define DOT11_TCLAS_FC_4_IPV6_LEN	44
+
+/* TCLAS frame classifier type 5 parameters for 802.1D */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
+	uint8 type;
+	uint8 mask;
+	uint8 pcp;
+	uint8 cfi;
+	uint16 vid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
+#define DOT11_TCLAS_FC_5_8021D_LEN	6
 
-#define DOT11_EXT_CAP_OBSS_COEX_MGMT		0
+/* TCLAS frame classifier type parameters */
+BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
+	uint8 data[1];
+	dot11_tclas_fc_hdr_t hdr;
+	dot11_tclas_fc_0_eth_t t0_eth;
+	dot11_tclas_fc_1_ipv4_t	t1_ipv4;
+	dot11_tclas_fc_2_8021q_t t2_8021q;
+	dot11_tclas_fc_3_filter_t t3_filter;
+	dot11_tclas_fc_4_ipv4_t	t4_ipv4;
+	dot11_tclas_fc_4_ipv6_t	t4_ipv6;
+	dot11_tclas_fc_5_8021d_t t5_8021d;
+} BWL_POST_PACKED_STRUCT;
+typedef union dot11_tclas_fc dot11_tclas_fc_t;
+
+#define DOT11_TCLAS_FC_MIN_LEN		4
+#define DOT11_TCLAS_FC_MAX_LEN		254
+
+/* TCLAS information element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
+	uint8 id;				/* 14, DOT11_MNG_TCLAS_ID */
+	uint8 len;
+	uint8 user_priority;
+	dot11_tclas_fc_t fc;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_ie dot11_tclas_ie_t;
+#define DOT11_TCLAS_IE_LEN		3	/* Fixed length, include id and len */
 
-#define DOT11_EXT_CAP_SPSMP					6
+/* TCLAS processing information element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
+	uint8 id;				/* 44, DOT11_MNG_TCLAS_PROC_ID */
+	uint8 len;
+	uint8 process;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
+#define DOT11_TCLAS_PROC_IE_LEN		3	/* Fixed length, include id and len */
 
-#define DOT11_EXT_CAP_BSS_TRANSITION_MGMT	19
+#define DOT11_TCLAS_PROC_MATCHALL	0	/* All high level element need to match */
+#define DOT11_TCLAS_PROC_MATCHONE	1	/* One high level element need to match */
+#define DOT11_TCLAS_PROC_NONMATCH	2	/* Non match to any high level element */
 
-#define DOT11_EXT_CAP_IW						31
 
-#define DOT11_EXT_CAP_SI						41
-#define DOT11_EXT_CAP_SI_MASK					0x0E
+/* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
+#define DOT11_TSPEC_IE_LEN		57	/* Fixed length */
 
+/* TFS request information element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
+	uint8 id;				/* 91, DOT11_MNG_TFS_REQUEST_ID */
+	uint8 len;
+	uint8 tfs_id;
+	uint8 tfs_actcode;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
+#define DOT11_TFS_REQ_IE_LEN		4	/* Fixed length, include id and len */
 
-#define DOT11_ACTION_HDR_LEN        2
-#define DOT11_ACTION_CAT_OFF        0
-#define DOT11_ACTION_ACT_OFF        1
+#define DOT11_TFS_ACTCODE_DELETE	1
+#define DOT11_TFS_ACTCODE_MODIFY	2
 
+/* TFS request subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_se {
+	uint8 sub_id;
+	uint8 length;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req_se dot11_tfs_req_se_t;
 
-#define DOT11_ACTION_CAT_ERR_MASK   0x80
-#define DOT11_ACTION_CAT_MASK       0x7F
-#define DOT11_ACTION_CAT_SPECT_MNG  0
-#define DOT11_ACTION_CAT_QOS        1
-#define DOT11_ACTION_CAT_DLS        2
-#define DOT11_ACTION_CAT_BLOCKACK   3
-#define DOT11_ACTION_CAT_PUBLIC     4
-#define DOT11_ACTION_CAT_RRM        5
-#define DOT11_ACTION_CAT_FBT    6
-#define DOT11_ACTION_CAT_HT     7
-#define	DOT11_ACTION_CAT_SA_QUERY	8	
-#define	DOT11_ACTION_CAT_PDPA		9	
-#define DOT11_ACTION_CAT_BSSMGMT	10	
-#define DOT11_ACTION_NOTIFICATION	17
-#define DOT11_ACTION_CAT_VSP		126	
-#define DOT11_ACTION_CAT_VS     127
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_se dot11_tfs_se_t;
+#define DOT11_TFS_REQ_SUBELEM_LEN	2	/* Fixed length, include id and len */
 
+#define DOT11_TFS_SUBELEM_ID_TFS	1
+#define DOT11_TFS_SUBELEM_ID_VENDOR	221
 
-#define DOT11_SM_ACTION_M_REQ       0
-#define DOT11_SM_ACTION_M_REP       1
-#define DOT11_SM_ACTION_TPC_REQ     2
-#define DOT11_SM_ACTION_TPC_REP     3
-#define DOT11_SM_ACTION_CHANNEL_SWITCH  4
-#define DOT11_SM_ACTION_EXT_CSA     5
+/* TFS response information element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
+	uint8 id;				/* 92, DOT11_MNG_TFS_RESPONSE_ID */
+	uint8 len;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
+#define DOT11_TFS_RESP_IE_LEN		2	/* Fixed length, include id and len */
 
+/* TFS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
+	uint8 id;				/* 92, DOT11_MNG_TFS_RESPONSE_ID */
+	uint8 len;
+	uint8 resp_st;
+	uint8 tfs_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
+
+#define DOT11_TFS_STATUS_SE_LEN		4	/* TFS Status Subelement length */
+#define DOT11_TFS_STATUS_SE_DATA_LEN	2	/* TFS status Subelement Data length */
+
+#define DOT11_TFS_STATUS_SE_ID_TFS_ST	1
+#define DOT11_TFS_STATUS_SE_ID_TFS	2
+#define DOT11_TFS_STATUS_SE_ID_VENDOR	221
+
+#define DOT11_TFS_RESP_ST_ACCEPT	0
+#define DOT11_TFS_RESP_ST_DENY_FORMAT	1
+#define DOT11_TFS_RESP_ST_DENY_RESOURCE	2
+#define DOT11_TFS_RESP_ST_DENY_POLICY	4
+#define DOT11_TFS_RESP_ST_PREFERRED_AP_INCAP	14
+
+
+/* TFS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: tfs request (13) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req dot11_tfs_req_t;
+#define DOT11_TFS_REQ_LEN		3	/* Fixed length */
+
+/* TFS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: tfs request (14) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp dot11_tfs_resp_t;
+#define DOT11_TFS_RESP_LEN		3	/* Fixed length */
+
+/* TFS Management Notify frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: tfs request (15) */
+	uint8 num_tfs_id;			/* number of TFS IDs */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify dot11_tfs_notify_t;
+#define DOT11_TFS_NOTIFY_LEN		3	/* Fixed length */
+
+#define DOT11_TFS_NOTIFY_ACT_DEL	1
+#define DOT11_TFS_NOTIFY_ACT_NOTIFY	2
+
+/* WNM-Sleep Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: wnm-sleep request (16) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
+#define DOT11_WNM_SLEEP_REQ_LEN		3	/* Fixed length */
+
+/* WNM-Sleep Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: wnm-sleep request (17) */
+	uint8 token;				/* dialog token */
+	uint16 key_len;				/* key data length */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
+#define DOT11_WNM_SLEEP_RESP_LEN	5	/* Fixed length */
+
+#define DOT11_WNM_SLEEP_SUBELEM_ID_GTK	0
+#define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK	1
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
+	uint8 sub_id;
+	uint8 len;
+	uint16 key_info;
+	uint8 key_length;
+	uint8 rsc[8];
+	uint8 key[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN	11	/* without sub_id, len, and key */
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN	43	/* without sub_id and len */
 
-#define DOT11_ACTION_ID_HT_CH_WIDTH 0
-#define DOT11_ACTION_ID_HT_MIMO_PS  1
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
+	uint8 sub_id;
+	uint8 len;
+	uint16 key_id;
+	uint8 pn[6];
+	uint8 key[16];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24	/* Fixed length */
 
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
+	uint8 id;				/* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
+	uint8 len;
+	uint8 act_type;
+	uint8 resp_status;
+	uint16 interval;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
+#define DOT11_WNM_SLEEP_IE_LEN		4	/* Fixed length */
+
+#define DOT11_WNM_SLEEP_ACT_TYPE_ENTER	0
+#define DOT11_WNM_SLEEP_ACT_TYPE_EXIT	1
+
+#define DOT11_WNM_SLEEP_RESP_ACCEPT	0
+#define DOT11_WNM_SLEEP_RESP_UPDATE	1
+#define DOT11_WNM_SLEEP_RESP_DENY	2
+#define DOT11_WNM_SLEEP_RESP_DENY_TEMP	3
+#define DOT11_WNM_SLEEP_RESP_DENY_KEY	4
+#define DOT11_WNM_SLEEP_RESP_DENY_INUSE	5
+#define DOT11_WNM_SLEEP_RESP_LAST	6
+
+/* DMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: dms request (23) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req dot11_dms_req_t;
+#define DOT11_DMS_REQ_LEN		3	/* Fixed length */
+
+/* DMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: dms request (24) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp dot11_dms_resp_t;
+#define DOT11_DMS_RESP_LEN		3	/* Fixed length */
+
+/* DMS request information element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
+	uint8 id;				/* 99, DOT11_MNG_DMS_REQUEST_ID */
+	uint8 len;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
+#define DOT11_DMS_REQ_IE_LEN		2	/* Fixed length */
 
-#define DOT11_PUB_ACTION_BSS_COEX_MNG   0
-#define DOT11_PUB_ACTION_CHANNEL_SWITCH 4
+/* DMS response information element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
+	uint8 id;				/* 100, DOT11_MNG_DMS_RESPONSE_ID */
+	uint8 len;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
+#define DOT11_DMS_RESP_IE_LEN		2	/* Fixed length */
 
+/* DMS request descriptor */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
+	uint8 dms_id;
+	uint8 len;
+	uint8 type;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
+#define DOT11_DMS_REQ_DESC_LEN		3	/* Fixed length */
 
-#define DOT11_BA_ACTION_ADDBA_REQ   0
-#define DOT11_BA_ACTION_ADDBA_RESP  1
-#define DOT11_BA_ACTION_DELBA       2
+#define DOT11_DMS_REQ_TYPE_ADD		0
+#define DOT11_DMS_REQ_TYPE_REMOVE	1
+#define DOT11_DMS_REQ_TYPE_CHANGE	2
 
+/* DMS response status */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
+	uint8 dms_id;
+	uint8 len;
+	uint8 type;
+	uint16 lsc;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
+#define DOT11_DMS_RESP_STATUS_LEN	5	/* Fixed length */
 
-#define DOT11_ADDBA_PARAM_AMSDU_SUP 0x0001
-#define DOT11_ADDBA_PARAM_POLICY_MASK   0x0002
-#define DOT11_ADDBA_PARAM_POLICY_SHIFT  1
-#define DOT11_ADDBA_PARAM_TID_MASK  0x003c
-#define DOT11_ADDBA_PARAM_TID_SHIFT 2
-#define DOT11_ADDBA_PARAM_BSIZE_MASK    0xffc0
-#define DOT11_ADDBA_PARAM_BSIZE_SHIFT   6
+#define DOT11_DMS_RESP_TYPE_ACCEPT	0
+#define DOT11_DMS_RESP_TYPE_DENY	1
+#define DOT11_DMS_RESP_TYPE_TERM	2
 
-#define DOT11_ADDBA_POLICY_DELAYED  0
-#define DOT11_ADDBA_POLICY_IMMEDIATE    1
+#define DOT11_DMS_RESP_LSC_UNSUPPORTED	0xFFFF
 
 BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
-	uint8 category;
-	uint8 action;
-	uint8 token;
-	uint16 addba_param_set;
-	uint16 timeout;
-	uint16 start_seqnum;
+	uint8 category;				/* category of action frame (3) */
+	uint8 action;				/* action: addba req */
+	uint8 token;				/* identifier */
+	uint16 addba_param_set;		/* parameter set */
+	uint16 timeout;				/* timeout in seconds */
+	uint16 start_seqnum;		/* starting sequence number */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_addba_req dot11_addba_req_t;
-#define DOT11_ADDBA_REQ_LEN     9
+#define DOT11_ADDBA_REQ_LEN		9	/* length of addba req frame */
 
 BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
-	uint8 category;
-	uint8 action;
-	uint8 token;
-	uint16 status;
-	uint16 addba_param_set;
-	uint16 timeout;
+	uint8 category;				/* category of action frame (3) */
+	uint8 action;				/* action: addba resp */
+	uint8 token;				/* identifier */
+	uint16 status;				/* status of add request */
+	uint16 addba_param_set;			/* negotiated parameter set */
+	uint16 timeout;				/* negotiated timeout in seconds */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_addba_resp dot11_addba_resp_t;
-#define DOT11_ADDBA_RESP_LEN        9
+#define DOT11_ADDBA_RESP_LEN		9	/* length of addba resp frame */
 
-
-#define DOT11_DELBA_PARAM_INIT_MASK 0x0800
-#define DOT11_DELBA_PARAM_INIT_SHIFT    11
-#define DOT11_DELBA_PARAM_TID_MASK  0xf000
-#define DOT11_DELBA_PARAM_TID_SHIFT 12
+/* DELBA action parameters */
+#define DOT11_DELBA_PARAM_INIT_MASK	0x0800	/* initiator mask */
+#define DOT11_DELBA_PARAM_INIT_SHIFT	11	/* initiator shift */
+#define DOT11_DELBA_PARAM_TID_MASK	0xf000	/* tid mask */
+#define DOT11_DELBA_PARAM_TID_SHIFT	12	/* tid shift */
 
 BWL_PRE_PACKED_STRUCT struct dot11_delba {
-	uint8 category;
-	uint8 action;
-	uint16 delba_param_set;
-	uint16 reason;
+	uint8 category;				/* category of action frame (3) */
+	uint8 action;				/* action: addba req */
+	uint16 delba_param_set;			/* paarmeter set */
+	uint16 reason;				/* reason for dellba */
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_delba dot11_delba_t;
-#define DOT11_DELBA_LEN         6
+#define DOT11_DELBA_LEN			6	/* length of delba frame */
+
+/* SA Query action field value */
+#define SA_QUERY_REQUEST		0
+#define SA_QUERY_RESPONSE		1
+
+/* ************* 802.11r related definitions. ************* */
+
+/* Over-the-DS Fast Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
+	uint8 category;			/* category of action frame (6) */
+	uint8 action;			/* action: ft req */
+	uint8 sta_addr[ETHER_ADDR_LEN];
+	uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_req dot11_ft_req_t;
+#define DOT11_FT_REQ_FIXED_LEN 14
+
+/* Over-the-DS Fast Transition Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
+	uint8 category;			/* category of action frame (6) */
+	uint8 action;			/* action: ft resp */
+	uint8 sta_addr[ETHER_ADDR_LEN];
+	uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+	uint16 status;			/* status code */
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_res dot11_ft_res_t;
+#define DOT11_FT_RES_FIXED_LEN 16
+
+/* RDE RIC Data Element. */
+BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
+	uint8 id;			/* 11r, DOT11_MNG_RDE_ID */
+	uint8 length;
+	uint8 rde_id;			/* RDE identifier. */
+	uint8 rd_count;			/* Resource Descriptor Count. */
+	uint16 status;			/* Status Code. */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rde_ie dot11_rde_ie_t;
 
+/* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
+#define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
 
 
+/* ************* 802.11k related definitions. ************* */
 
+/* Radio measurements enabled capability ie */
 
-#define DOT11_RRM_CAP_LEN       5
+#define DOT11_RRM_CAP_LEN		5	/* length of rrm cap bitmap */
+#define RCPI_IE_LEN 1
+#define RSNI_IE_LEN 1
 BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
 	uint8 cap[DOT11_RRM_CAP_LEN];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
 
+/* Bitmap definitions for cap ie */
+#define DOT11_RRM_CAP_LINK			0
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT	1
+#define DOT11_RRM_CAP_PARALLEL		2
+#define DOT11_RRM_CAP_REPEATED		3
+#define DOT11_RRM_CAP_BCN_PASSIVE	4
+#define DOT11_RRM_CAP_BCN_ACTIVE	5
+#define DOT11_RRM_CAP_BCN_TABLE		6
+#define DOT11_RRM_CAP_BCN_REP_COND	7
+#define DOT11_RRM_CAP_AP_CHANREP	16
 
-#define DOT11_RRM_CAP_LINK          0
-#define DOT11_RRM_CAP_NEIGHBOR_REPORT   1
-#define DOT11_RRM_CAP_PARALLEL      2
-#define DOT11_RRM_CAP_REPEATED      3
-#define DOT11_RRM_CAP_BCN_PASSIVE   4
-#define DOT11_RRM_CAP_BCN_ACTIVE    5
-#define DOT11_RRM_CAP_BCN_TABLE     6
-#define DOT11_RRM_CAP_BCN_REP_COND  7
-#define DOT11_RRM_CAP_AP_CHANREP    16
 
+/* Operating Class (formerly "Regulatory Class") definitions */
+#define DOT11_OP_CLASS_NONE			255
 
-#define DOT11_RM_ACTION_RM_REQ      0
-#define DOT11_RM_ACTION_RM_REP      1
-#define DOT11_RM_ACTION_LM_REQ      2
-#define DOT11_RM_ACTION_LM_REP      3
-#define DOT11_RM_ACTION_NR_REQ      4
-#define DOT11_RM_ACTION_NR_REP      5
+BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
+	uint8 id;
+	uint8 len;
+	uint8 reg;
+	uint8 chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct do11_ap_chrep dot11_ap_chrep_t;
 
+/* Radio Measurements action ids */
+#define DOT11_RM_ACTION_RM_REQ		0	/* Radio measurement request */
+#define DOT11_RM_ACTION_RM_REP		1	/* Radio measurement report */
+#define DOT11_RM_ACTION_LM_REQ		2	/* Link measurement request */
+#define DOT11_RM_ACTION_LM_REP		3	/* Link measurement report */
+#define DOT11_RM_ACTION_NR_REQ		4	/* Neighbor report request */
+#define DOT11_RM_ACTION_NR_REP		5	/* Neighbor report response */
 
+/* Generic radio measurement action frame header */
 BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
-	uint8 category;
-	uint8 action;
-	uint8 token;
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
 	uint8 data[1];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rm_action dot11_rm_action_t;
 #define DOT11_RM_ACTION_LEN 3
 
 BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
-	uint8 category;
-	uint8 action;
-	uint8 token;
-	uint16 reps;
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	uint16 reps;				/* no. of repetitions */
+	uint8 data[1];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rmreq dot11_rmreq_t;
-#define DOT11_RMREQ_LEN 5
+#define DOT11_RMREQ_LEN	5
 
 BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
 	uint8 id;
@@ -1276,19 +2238,19 @@ BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
 	uint8 type;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rm_ie dot11_rm_ie_t;
-#define DOT11_RM_IE_LEN 5
-
+#define DOT11_RM_IE_LEN	5
 
-#define DOT11_RMREQ_MODE_PARALLEL   1
-#define DOT11_RMREQ_MODE_ENABLE     2
-#define DOT11_RMREQ_MODE_REQUEST    4
-#define DOT11_RMREQ_MODE_REPORT     8
-#define DOT11_RMREQ_MODE_DURMAND    0x10
+/* Definitions for "mode" bits in rm req */
+#define DOT11_RMREQ_MODE_PARALLEL	1
+#define DOT11_RMREQ_MODE_ENABLE		2
+#define DOT11_RMREQ_MODE_REQUEST	4
+#define DOT11_RMREQ_MODE_REPORT		8
+#define DOT11_RMREQ_MODE_DURMAND	0x10	/* Duration Mandatory */
 
-
-#define DOT11_RMREP_MODE_LATE       1
-#define DOT11_RMREP_MODE_INCAPABLE  2
-#define DOT11_RMREP_MODE_REFUSED    4
+/* Definitions for "mode" bits in rm rep */
+#define DOT11_RMREP_MODE_LATE		1
+#define DOT11_RMREP_MODE_INCAPABLE	2
+#define DOT11_RMREP_MODE_REFUSED	4
 
 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
 	uint8 id;
@@ -1301,10 +2263,10 @@ BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
 	uint16 interval;
 	uint16 duration;
 	uint8 bcn_mode;
-	struct ether_addr   bssid;
+	struct ether_addr	bssid;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
-#define DOT11_RMREQ_BCN_LEN 18
+#define DOT11_RMREQ_BCN_LEN	18
 
 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
 	uint8 reg;
@@ -1314,90 +2276,318 @@ BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
 	uint8 frame_info;
 	uint8 rcpi;
 	uint8 rsni;
-	struct ether_addr   bssid;
+	struct ether_addr	bssid;
 	uint8 antenna_id;
 	uint32 parent_tsf;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
-#define DOT11_RMREP_BCN_LEN 26
-
-
-#define DOT11_RMREQ_BCN_PASSIVE 0
-#define DOT11_RMREQ_BCN_ACTIVE  1
-#define DOT11_RMREQ_BCN_TABLE   2
+#define DOT11_RMREP_BCN_LEN	26
 
+/* Beacon request measurement mode */
+#define DOT11_RMREQ_BCN_PASSIVE	0
+#define DOT11_RMREQ_BCN_ACTIVE	1
+#define DOT11_RMREQ_BCN_TABLE	2
 
+/* Sub-element IDs for Beacon Request */
 #define DOT11_RMREQ_BCN_SSID_ID 0
 #define DOT11_RMREQ_BCN_REPINFO_ID  1
 #define DOT11_RMREQ_BCN_REPDET_ID   2
 #define DOT11_RMREQ_BCN_REQUEST_ID  10
-#define DOT11_RMREQ_BCN_APCHREP_ID  51
+#define DOT11_RMREQ_BCN_APCHREP_ID  DOT11_MNG_AP_CHREP_ID
 
+/* Reporting Detail element definition */
+#define DOT11_RMREQ_BCN_REPDET_FIXED	0	/* Fixed length fields only */
+#define DOT11_RMREQ_BCN_REPDET_REQUEST	1	/* + requested information elems */
+#define DOT11_RMREQ_BCN_REPDET_ALL	2	/* All fields */
 
-#define DOT11_RMREQ_BCN_REPDET_FIXED    0
-#define DOT11_RMREQ_BCN_REPDET_REQUEST  1
-#define DOT11_RMREQ_BCN_REPDET_ALL  2
+/* Sub-element IDs for Beacon Report */
+#define DOT11_RMREP_BCN_FRM_BODY	1
 
+/* Sub-element IDs for Frame Report */
+#define DOT11_RMREP_FRAME_COUNT_REPORT 1
 
-#define DOT11_RMREP_BCN_FRM_BODY    1
+/* Channel load request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 reg;
+	uint8 channel;
+	uint16 interval;
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
+#define DOT11_RMREQ_CHANLOAD_LEN	11
 
+/* Channel load report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+	uint8 channel_load;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
+#define DOT11_RMREP_CHANLOAD_LEN	13
 
-BWL_PRE_PACKED_STRUCT struct dot11_rmrep_nbr {
-	struct ether_addr   bssid;
-	uint32  bssid_info;
+/* Noise histogram request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
 	uint8 reg;
 	uint8 channel;
-	uint8 phytype;
+	uint16 interval;
+	uint16 duration;
 } BWL_POST_PACKED_STRUCT;
-typedef struct dot11_rmrep_nbr dot11_rmrep_nbr_t;
-#define DOT11_RMREP_NBR_LEN 13
+typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
+#define DOT11_RMREQ_NOISE_LEN 11
 
+/* Noise histogram report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+	uint8 antid;
+	uint8 anpi;
+	uint8 ipi0_dens;
+	uint8 ipi1_dens;
+	uint8 ipi2_dens;
+	uint8 ipi3_dens;
+	uint8 ipi4_dens;
+	uint8 ipi5_dens;
+	uint8 ipi6_dens;
+	uint8 ipi7_dens;
+	uint8 ipi8_dens;
+	uint8 ipi9_dens;
+	uint8 ipi10_dens;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
+#define DOT11_RMREP_NOISE_LEN 25
+
+/* Frame request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 reg;
+	uint8 channel;
+	uint16 interval;
+	uint16 duration;
+	uint8 req_type;
+	struct ether_addr	ta;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
+#define DOT11_RMREQ_FRAME_LEN 18
 
-#define DOT11_BSSTYPE_INFRASTRUCTURE        0
-#define DOT11_BSSTYPE_INDEPENDENT       1
-#define DOT11_BSSTYPE_ANY           2
-#define DOT11_SCANTYPE_ACTIVE           0
-#define DOT11_SCANTYPE_PASSIVE          1
+/* Frame report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
+#define DOT11_RMREP_FRAME_LEN 12
+
+/* Frame report entry */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
+	struct ether_addr	ta;
+	struct ether_addr	bssid;
+	uint8 phy_type;
+	uint8 avg_rcpi;
+	uint8 last_rsni;
+	uint8 last_rcpi;
+	uint8 ant_id;
+	uint16 frame_cnt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
+#define DOT11_RMREP_FRMENTRY_LEN 19
+
+/* STA statistics request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	struct ether_addr	peer;
+	uint16 interval;
+	uint16 duration;
+	uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
+#define DOT11_RMREQ_STAT_LEN 16
 
+/* STA statistics report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
+	uint16 duration;
+	uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
 
-BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
-	uint8 category;
-	uint8 action;
+/* Transmit stream/category measurement request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
+	uint8 id;
+	uint8 len;
 	uint8 token;
-	uint8 txpwr;
-	uint8 maxtxpwr;
+	uint8 mode;
+	uint8 type;
+	uint16 interval;
+	uint16 duration;
+	struct ether_addr	peer;
+	uint8 traffic_id;
+	uint8 bin0_range;
 } BWL_POST_PACKED_STRUCT;
-typedef struct dot11_lmreq dot11_lmreq_t;
-#define DOT11_LMREQ_LEN 5
+typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
 
-BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
-	uint8 category;
-	uint8 action;
+/* Transmit stream/category measurement report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
+	uint32 starttime[2];
+	uint16 duration;
+	struct ether_addr	peer;
+	uint8 traffic_id;
+	uint8 reason;
+	uint32 txmsdu_cnt;
+	uint32 msdu_discarded_cnt;
+	uint32 msdufailed_cnt;
+	uint32 msduretry_cnt;
+	uint32 cfpolls_lost_cnt;
+	uint32 avrqueue_delay;
+	uint32 avrtx_delay;
+	uint8 bin0_range;
+	uint32 bin0;
+	uint32 bin1;
+	uint32 bin2;
+	uint32 bin3;
+	uint32 bin4;
+	uint32 bin5;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
+
+/* Measurement pause request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
+	uint8 id;
+	uint8 len;
 	uint8 token;
-	dot11_tpc_rep_t tpc;
-	uint8 rxant;
-	uint8 txant;
-	uint8 rcpi;
-	uint8 rsni;
+	uint8 mode;
+	uint8 type;
+	uint16 pause_time;
 } BWL_POST_PACKED_STRUCT;
-typedef struct dot11_lmrep dot11_lmrep_t;
-#define DOT11_LMREP_LEN 11
+typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
 
 
-#define PREN_PREAMBLE       24
-#define PREN_MM_EXT     12
-#define PREN_PREAMBLE_EXT   4
+/* Neighbor Report subelements ID (11k & 11v) */
+#define DOT11_NGBR_TSF_INFO_SE_ID	1
+#define DOT11_NGBR_CCS_SE_ID		2
+#define DOT11_NGBR_BSSTRANS_PREF_SE_ID	3
+#define DOT11_NGBR_BSS_TERM_DUR_SE_ID	4
+#define DOT11_NGBR_BEARING_SE_ID	5
 
+/* Neighbor Report, BSS Transition Candidate Preference subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 preference;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
+#define DOT11_NGBR_BSSTRANS_PREF_SE_LEN	1
 
-#define RIFS_11N_TIME       2
+/* Neighbor Report, BSS Termination Duration subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 tsf[8];
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
+#define DOT11_NGBR_BSS_TERM_DUR_SE_LEN	10
+
+/* Neighbor Report BSSID Information Field */
+#define DOT11_NGBR_BI_REACHABILTY_UNKN	0x0002
+#define DOT11_NGBR_BI_REACHABILTY	0x0003
+#define DOT11_NGBR_BI_SEC		0x0004
+#define DOT11_NGBR_BI_KEY_SCOPE		0x0008
+#define DOT11_NGBR_BI_CAP		0x03f0
+#define DOT11_NGBR_BI_CAP_SPEC_MGMT	0x0010
+#define DOT11_NGBR_BI_CAP_QOS		0x0020
+#define DOT11_NGBR_BI_CAP_APSD		0x0040
+#define DOT11_NGBR_BI_CAP_RDIO_MSMT	0x0080
+#define DOT11_NGBR_BI_CAP_DEL_BA	0x0100
+#define DOT11_NGBR_BI_CAP_IMM_BA	0x0200
+#define DOT11_NGBR_BI_MOBILITY		0x0400
+#define DOT11_NGBR_BI_HT		0x0800
+
+/* Neighbor Report element (11k & 11v) */
+BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
+	uint8 id;
+	uint8 len;
+	struct ether_addr bssid;
+	uint32 bssid_info;
+	uint8 reg;		/* Operating class */
+	uint8 channel;
+	uint8 phytype;
+	uint8 data[1]; 		/* Variable size subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
+#define DOT11_NEIGHBOR_REP_IE_FIXED_LEN	13
 
 
+/* MLME Enumerations */
+#define DOT11_BSSTYPE_INFRASTRUCTURE		0	/* d11 infrastructure */
+#define DOT11_BSSTYPE_INDEPENDENT		1	/* d11 independent */
+#define DOT11_BSSTYPE_ANY			2	/* d11 any BSS type */
+#define DOT11_SCANTYPE_ACTIVE			0	/* d11 scan active */
+#define DOT11_SCANTYPE_PASSIVE			1	/* d11 scan passive */
 
+/* Link Measurement */
+BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	uint8 txpwr;				/* Transmit Power Used */
+	uint8 maxtxpwr;				/* Max Transmit Power */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmreq dot11_lmreq_t;
+#define DOT11_LMREQ_LEN	5
+
+BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	dot11_tpc_rep_t tpc;			/* TPC element */
+	uint8 rxant;				/* Receive Antenna ID */
+	uint8 txant;				/* Transmit Antenna ID */
+	uint8 rcpi;				/* RCPI */
+	uint8 rsni;				/* RSNI */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmrep dot11_lmrep_t;
+#define DOT11_LMREP_LEN	11
+
+/* 802.11 BRCM "Compromise" Pre N constants */
+#define PREN_PREAMBLE		24	/* green field preamble time */
+#define PREN_MM_EXT		12	/* extra mixed mode preamble time */
+#define PREN_PREAMBLE_EXT	4	/* extra preamble (multiply by unique_streams-1) */
+
+/* 802.11N PHY constants */
+#define RIFS_11N_TIME		2	/* NPHY RIFS time */
+
+/* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
+ * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
+ */
+/* HT-SIG1 */
 #define HT_SIG1_MCS_MASK        0x00007F
 #define HT_SIG1_CBW             0x000080
 #define HT_SIG1_HT_LENGTH       0xFFFF00
 
-
+/* HT-SIG2 */
 #define HT_SIG2_SMOOTHING       0x000001
 #define HT_SIG2_NOT_SOUNDING    0x000002
 #define HT_SIG2_RESERVED        0x000004
@@ -1411,385 +2601,736 @@ typedef struct dot11_lmrep dot11_lmrep_t;
 #define HT_SIG2_CRC             0x03FC00
 #define HT_SIG2_TAIL            0x1C0000
 
-
-#define APHY_SLOT_TIME      9
-#define APHY_SIFS_TIME      16
-#define APHY_DIFS_TIME      (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))
-#define APHY_PREAMBLE_TIME  16
-#define APHY_SIGNAL_TIME    4
-#define APHY_SYMBOL_TIME    4
-#define APHY_SERVICE_NBITS  16
-#define APHY_TAIL_NBITS     6
-#define APHY_CWMIN      15
-
-
-#define BPHY_SLOT_TIME      20
-#define BPHY_SIFS_TIME      10
-#define BPHY_DIFS_TIME      50
-#define BPHY_PLCP_TIME      192
-#define BPHY_PLCP_SHORT_TIME    96
-#define BPHY_CWMIN      31
-
-
-#define DOT11_OFDM_SIGNAL_EXTENSION 6
-
-#define PHY_CWMAX       1023
-
-#define DOT11_MAXNUMFRAGS   16
-
-
+/* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
+#define HT_T_LEG_PREAMBLE      16
+#define HT_T_L_SIG              4
+#define HT_T_SIG                8
+#define HT_T_LTF1               4
+#define HT_T_GF_LTF1            8
+#define HT_T_LTFs               4
+#define HT_T_STF                4
+#define HT_T_GF_STF             8
+#define HT_T_SYML               4
+
+#define HT_N_SERVICE           16       /* bits in SERVICE field */
+#define HT_N_TAIL               6       /* tail bits per BCC encoder */
+
+/* 802.11 A PHY constants */
+#define APHY_SLOT_TIME          9       /* APHY slot time */
+#define APHY_SIFS_TIME          16      /* APHY SIFS time */
+#define APHY_DIFS_TIME          (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))  /* APHY DIFS time */
+#define APHY_PREAMBLE_TIME      16      /* APHY preamble time */
+#define APHY_SIGNAL_TIME        4       /* APHY signal time */
+#define APHY_SYMBOL_TIME        4       /* APHY symbol time */
+#define APHY_SERVICE_NBITS      16      /* APHY service nbits */
+#define APHY_TAIL_NBITS         6       /* APHY tail nbits */
+#define APHY_CWMIN              15      /* APHY cwmin */
+
+/* 802.11 B PHY constants */
+#define BPHY_SLOT_TIME          20      /* BPHY slot time */
+#define BPHY_SIFS_TIME          10      /* BPHY SIFS time */
+#define BPHY_DIFS_TIME          50      /* BPHY DIFS time */
+#define BPHY_PLCP_TIME          192     /* BPHY PLCP time */
+#define BPHY_PLCP_SHORT_TIME    96      /* BPHY PLCP short time */
+#define BPHY_CWMIN              31      /* BPHY cwmin */
+
+/* 802.11 G constants */
+#define DOT11_OFDM_SIGNAL_EXTENSION	6	/* d11 OFDM signal extension */
+
+#define PHY_CWMAX		1023	/* PHY cwmax */
+
+#define	DOT11_MAXNUMFRAGS	16	/* max # fragments per MSDU */
+
+/* 802.11 VHT constants */
+
+typedef int vht_group_id_t;
+
+/* for VHT-A1 */
+/* SIG-A1 reserved bits */
+#define VHT_SIGA1_CONST_MASK            0x800004
+
+#define VHT_SIGA1_BW_MASK               0x000003
+#define VHT_SIGA1_20MHZ_VAL             0x000000
+#define VHT_SIGA1_40MHZ_VAL             0x000001
+#define VHT_SIGA1_80MHZ_VAL             0x000002
+#define VHT_SIGA1_160MHZ_VAL            0x000003
+
+#define VHT_SIGA1_STBC                  0x000008
+
+#define VHT_SIGA1_GID_MASK              0x0003f0
+#define VHT_SIGA1_GID_SHIFT             4
+#define VHT_SIGA1_GID_TO_AP             0x00
+#define VHT_SIGA1_GID_NOT_TO_AP         0x3f
+#define VHT_SIGA1_GID_MAX_GID           0x3f
+
+#define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
+#define VHT_SIGA1_NSTS_SHIFT            10
+
+#define VHT_SIGA1_PARTIAL_AID_MASK      0x3fe000
+#define VHT_SIGA1_PARTIAL_AID_SHIFT     13
+
+#define VHT_SIGA1_TXOP_PS_NOT_ALLOWED   0x400000
+
+/* for VHT-A2 */
+#define VHT_SIGA2_GI_NONE               0x000000
+#define VHT_SIGA2_GI_SHORT              0x000001
+#define VHT_SIGA2_GI_W_MOD10            0x000002
+#define VHT_SIGA2_CODING_LDPC           0x000004
+#define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM   0x000008
+#define VHT_SIGA2_BEAMFORM_ENABLE       0x000100
+#define VHT_SIGA2_MCS_SHIFT             4
+
+#define VHT_SIGA2_B9_RESERVED           0x000200
+#define VHT_SIGA2_TAIL_MASK             0xfc0000
+#define VHT_SIGA2_TAIL_VALUE            0x000000
+
+/* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
+#define VHT_T_LEG_PREAMBLE      16
+#define VHT_T_L_SIG              4
+#define VHT_T_SIG_A              8
+#define VHT_T_LTF                4
+#define VHT_T_STF                4
+#define VHT_T_SIG_B              4
+#define VHT_T_SYML               4
+
+#define VHT_N_SERVICE           16	/* bits in SERVICE field */
+#define VHT_N_TAIL               6	/* tail bits per BCC encoder */
+
+
+/* dot11Counters Table - 802.11 spec., Annex D */
 typedef struct d11cnt {
-	uint32      txfrag;
-	uint32      txmulti;
-	uint32      txfail;
-	uint32      txretry;
-	uint32      txretrie;
-	uint32      rxdup;
-	uint32      txrts;
-	uint32      txnocts;
-	uint32      txnoack;
-	uint32      rxfrag;
-	uint32      rxmulti;
-	uint32      rxcrc;
-	uint32      txfrmsnt;
-	uint32      rxundec;
+	uint32		txfrag;		/* dot11TransmittedFragmentCount */
+	uint32		txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32		txfail;		/* dot11FailedCount */
+	uint32		txretry;	/* dot11RetryCount */
+	uint32		txretrie;	/* dot11MultipleRetryCount */
+	uint32		rxdup;		/* dot11FrameduplicateCount */
+	uint32		txrts;		/* dot11RTSSuccessCount */
+	uint32		txnocts;	/* dot11RTSFailureCount */
+	uint32		txnoack;	/* dot11ACKFailureCount */
+	uint32		rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32		rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32		rxcrc;		/* dot11FCSErrorCount */
+	uint32		txfrmsnt;	/* dot11TransmittedFrameCount */
+	uint32		rxundec;	/* dot11WEPUndecryptableCount */
 } d11cnt_t;
 
-
-#define BRCM_PROP_OUI       "\x00\x90\x4C"
-
+/* OUI for BRCM proprietary IE */
+#define BRCM_PROP_OUI		"\x00\x90\x4C"	/* Broadcom proprietary OUI */
 
 
-#define BRCM_OUI        "\x00\x10\x18"
+/* brcm syscap_ie cap */
+#define BRCM_SYSCAP_WET_TUNNEL	0x0100	/* Device with WET_TUNNEL support */
 
+/* BRCM OUI: Used in the proprietary(221) IE in all broadcom devices */
+#define BRCM_OUI		"\x00\x10\x18"	/* Broadcom OUI */
 
+/* BRCM info element */
 BWL_PRE_PACKED_STRUCT struct brcm_ie {
-	uint8   id;
-	uint8   len;
-	uint8   oui[3];
-	uint8   ver;
-	uint8   assoc;
-	uint8   flags;
-	uint8   flags1;
-	uint16  amsdu_mtu_pref;
-} BWL_POST_PACKED_STRUCT;
-typedef struct brcm_ie brcm_ie_t;
-#define BRCM_IE_LEN     11
-#define BRCM_IE_VER     2
-#define BRCM_IE_LEGACY_AES_VER  1
-
-
-#ifdef WLAFTERBURNER
-#define BRF_ABCAP       0x1
-#define BRF_ABRQRD      0x2
-#define BRF_ABCOUNTER_MASK  0xf0
-#define BRF_ABCOUNTER_SHIFT 4
-#endif
-#define BRF_LZWDS       0x4
-#define BRF_BLOCKACK        0x8
-
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];		/* Proprietary OUI, BRCM_OUI */
+	uint8	ver;		/* type/ver of this IE */
+	uint8	assoc;		/* # of assoc STAs */
+	uint8	flags;		/* misc flags */
+	uint8	flags1;		/* misc flags */
+	uint16	amsdu_mtu_pref;	/* preferred A-MSDU MTU */
+} BWL_POST_PACKED_STRUCT;
+typedef	struct brcm_ie brcm_ie_t;
+#define BRCM_IE_LEN		11	/* BRCM IE length */
+#define BRCM_IE_VER		2	/* BRCM IE version */
+#define BRCM_IE_LEGACY_AES_VER	1	/* BRCM IE legacy AES version */
+
+/* brcm_ie flags */
+#define	BRF_LZWDS		0x4	/* lazy wds enabled */
+#define	BRF_BLOCKACK		0x8	/* BlockACK capable */
+
+/* brcm_ie flags1 */
+#define	BRF1_AMSDU		0x1	/* A-MSDU capable */
+#define BRF1_WMEPS		0x4	/* AP is capable of handling WME + PS w/o APSD */
+#define BRF1_PSOFIX		0x8	/* AP has fixed PS mode out-of-order packets */
+#define	BRF1_RX_LARGE_AGG	0x10	/* device can rx large aggregates */
+#define BRF1_RFAWARE_DCS	0x20    /* RFAWARE dynamic channel selection (DCS) */
+#define BRF1_SOFTAP		0x40    /* Configure as Broadcom SOFTAP */
+#define BRF1_DWDS		0x80    /* DWDS capable */
+
+/* Vendor IE structure */
+BWL_PRE_PACKED_STRUCT struct vndr_ie {
+	uchar id;
+	uchar len;
+	uchar oui [3];
+	uchar data [1]; 	/* Variable size data */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vndr_ie vndr_ie_t;
 
-#define BRF1_AMSDU      0x1
-#define BRF1_WMEPS      0x4
-#define BRF1_PSOFIX     0x8
-#define BRF1_RX_LARGE_AGG   0x10
-#define BRF1_SOFTAP             0x40
+#define VNDR_IE_HDR_LEN		2	/* id + len field */
+#define VNDR_IE_MIN_LEN		3	/* size of the oui field */
+#define VNDR_IE_FIXED_LEN	(VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
 
-#ifdef WLAFTERBURNER
-#define AB_WDS_TIMEOUT_MAX  15
-#define AB_WDS_TIMEOUT_MIN  1
-#endif
+#define VNDR_IE_MAX_LEN		255	/* vendor IE max length, without ID and len */
 
-#define AB_GUARDCOUNT   10
+/* BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
+BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
+	uchar id;
+	uchar len;
+	uchar oui[3];
+	uint8	type;           /* type inidicates what follows */
+	struct ether_addr ea;   /* Device Primary MAC Adrress */
+} BWL_POST_PACKED_STRUCT;
+typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
 
+#define MEMBER_OF_BRCM_PROP_IE_LEN		10	/* IE max length */
+#define MEMBER_OF_BRCM_PROP_IE_TYPE		54
 
-BWL_PRE_PACKED_STRUCT struct vndr_ie {
+/* BRCM Reliable Multicast IE */
+BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
 	uchar id;
 	uchar len;
-	uchar oui [3];
-	uchar data [1];
+	uchar oui[3];
+	uint8 type;           /* type inidicates what follows */
+	struct ether_addr ea;   /* The ack sender's MAC Adrress */
+	struct ether_addr mcast_ea;  /* The multicast MAC address */
+	uint8 updtmo; /* time interval(second) for client to send null packet to report its rssi */
 } BWL_POST_PACKED_STRUCT;
-typedef struct vndr_ie vndr_ie_t;
-
-#define VNDR_IE_HDR_LEN     2
-#define VNDR_IE_MIN_LEN     3
-#define VNDR_IE_MAX_LEN     256
+typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
 
+#define RELMCAST_BRCM_PROP_IE_LEN	(sizeof(relmcast_brcm_prop_ie_t)-2)	/* IE length */
+#define RELMCAST_BRCM_PROP_IE_TYPE	55
 
-#define MCSSET_LEN  16
-#define MAX_MCS_NUM (128)
+/* ************* HT definitions. ************* */
+#define MCSSET_LEN	16	/* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
+#define MAX_MCS_NUM	(128)	/* max mcs number = 128 */
 
 BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
-	uint16  cap;
-	uint8   params;
-	uint8   supp_mcs[MCSSET_LEN];
-	uint16  ext_htcap;
-	uint32  txbf_cap;
-	uint8   as_cap;
+	uint16	cap;
+	uint8	params;
+	uint8	supp_mcs[MCSSET_LEN];
+	uint16	ext_htcap;
+	uint32	txbf_cap;
+	uint8	as_cap;
 } BWL_POST_PACKED_STRUCT;
 typedef struct ht_cap_ie ht_cap_ie_t;
 
+BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
+	uint8	id;
+	uint8	len;
+	ht_cap_ie_t ht_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
 
-
+/* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the capability IE is primarily used to convey this nodes abilities */
 BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
-	uint8   id;
-	uint8   len;
-	uint8   oui[3];
-	uint8   type;
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
+	uint8	type;           /* type inidicates what follows */
 	ht_cap_ie_t cap_ie;
 } BWL_POST_PACKED_STRUCT;
 typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
 
-#define HT_PROP_IE_OVERHEAD 4
-#define HT_CAP_IE_LEN       26
-#define HT_CAP_IE_TYPE      51
-
-#define HT_CAP_LDPC_CODING  0x0001
-#define HT_CAP_40MHZ        0x0002
-#define HT_CAP_MIMO_PS_MASK 0x000C
-#define HT_CAP_MIMO_PS_SHIFT    0x0002
-#define HT_CAP_MIMO_PS_OFF  0x0003
-#define HT_CAP_MIMO_PS_RTS  0x0001
-#define HT_CAP_MIMO_PS_ON   0x0000
-#define HT_CAP_GF       0x0010
-#define HT_CAP_SHORT_GI_20  0x0020
-#define HT_CAP_SHORT_GI_40  0x0040
-#define HT_CAP_TX_STBC      0x0080
-#define HT_CAP_RX_STBC_MASK 0x0300
-#define HT_CAP_RX_STBC_SHIFT    8
-#define HT_CAP_DELAYED_BA   0x0400
-#define HT_CAP_MAX_AMSDU    0x0800
-#define HT_CAP_DSSS_CCK 0x1000
-#define HT_CAP_PSMP     0x2000
-#define HT_CAP_40MHZ_INTOLERANT 0x4000
-#define HT_CAP_LSIG_TXOP    0x8000
-
-#define HT_CAP_RX_STBC_NO       0x0
-#define HT_CAP_RX_STBC_ONE_STREAM   0x1
-#define HT_CAP_RX_STBC_TWO_STREAM   0x2
-#define HT_CAP_RX_STBC_THREE_STREAM 0x3
-
-#define HT_MAX_AMSDU        7935
-#define HT_MIN_AMSDU        3835
-
-#define HT_PARAMS_RX_FACTOR_MASK    0x03
-#define HT_PARAMS_DENSITY_MASK      0x1C
-#define HT_PARAMS_DENSITY_SHIFT 2
-
-
-#define AMPDU_MAX_MPDU_DENSITY  7
-#define AMPDU_RX_FACTOR_8K  0
-#define AMPDU_RX_FACTOR_16K 1
-#define AMPDU_RX_FACTOR_32K 2
-#define AMPDU_RX_FACTOR_64K 3
-#define AMPDU_RX_FACTOR_BASE    8*1024
-
-#define AMPDU_DELIMITER_LEN 4
-#define AMPDU_DELIMITER_LEN_MAX 63
+#define HT_PROP_IE_OVERHEAD	4	/* overhead bytes for prop oui ie */
+#define HT_CAP_IE_LEN		26	/* HT capability len (based on .11n d2.0) */
+#define HT_CAP_IE_TYPE		51
+
+#define HT_CAP_LDPC_CODING	0x0001	/* Support for rx of LDPC coded pkts */
+#define HT_CAP_40MHZ		0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define HT_CAP_MIMO_PS_MASK	0x000C  /* Mimo PS mask */
+#define HT_CAP_MIMO_PS_SHIFT	0x0002	/* Mimo PS shift */
+#define HT_CAP_MIMO_PS_OFF	0x0003	/* Mimo PS, no restriction */
+#define HT_CAP_MIMO_PS_RTS	0x0001	/* Mimo PS, send RTS/CTS around MIMO frames */
+#define HT_CAP_MIMO_PS_ON	0x0000	/* Mimo PS, MIMO disallowed */
+#define HT_CAP_GF		0x0010	/* Greenfield preamble support */
+#define HT_CAP_SHORT_GI_20	0x0020	/* 20MHZ short guard interval support */
+#define HT_CAP_SHORT_GI_40	0x0040	/* 40Mhz short guard interval support */
+#define HT_CAP_TX_STBC		0x0080	/* Tx STBC support */
+#define HT_CAP_RX_STBC_MASK	0x0300	/* Rx STBC mask */
+#define HT_CAP_RX_STBC_SHIFT	8	/* Rx STBC shift */
+#define HT_CAP_DELAYED_BA	0x0400	/* delayed BA support */
+#define HT_CAP_MAX_AMSDU	0x0800	/* Max AMSDU size in bytes , 0=3839, 1=7935 */
+
+#define HT_CAP_DSSS_CCK	0x1000	/* DSSS/CCK supported by the BSS */
+#define HT_CAP_PSMP		0x2000	/* Power Save Multi Poll support */
+#define HT_CAP_40MHZ_INTOLERANT 0x4000	/* 40MHz Intolerant */
+#define HT_CAP_LSIG_TXOP	0x8000	/* L-SIG TXOP protection support */
+
+#define HT_CAP_RX_STBC_NO		0x0	/* no rx STBC support */
+#define HT_CAP_RX_STBC_ONE_STREAM	0x1	/* rx STBC support of 1 spatial stream */
+#define HT_CAP_RX_STBC_TWO_STREAM	0x2	/* rx STBC support of 1-2 spatial streams */
+#define HT_CAP_RX_STBC_THREE_STREAM	0x3	/* rx STBC support of 1-3 spatial streams */
+
+
+#define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX	0x1
+#define HT_CAP_TXBF_CAP_NDP_TX			0x8
+#define HT_CAP_TXBF_CAP_NDP_RX			0x10
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI		0x100
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING	0x200
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING	0x400
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK	0x1800
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT	11
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK	0x6000
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT	13
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK	0x18000
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT	15
+#define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT	19
+#define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT	21
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT		23
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK		0x1800000
+
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT	27
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK		0x18000000
+
+#define HT_CAP_TXBF_FB_TYPE_NONE 	0
+#define HT_CAP_TXBF_FB_TYPE_DELAYED 	1
+#define HT_CAP_TXBF_FB_TYPE_IMMEDIATE 	2
+#define HT_CAP_TXBF_FB_TYPE_BOTH 	3
+
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK	0x400
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT	10
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
+
+#define VHT_MAX_MPDU		11454	/* max mpdu size for now (bytes) */
+#define VHT_MPDU_MSDU_DELTA	56		/* Difference in spec - vht mpdu, amsdu len */
+/* Max AMSDU len - per spec */
+#define VHT_MAX_AMSDU		(VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
+
+#define HT_MAX_AMSDU		7935	/* max amsdu size (bytes) per the HT spec */
+#define HT_MIN_AMSDU		3835	/* min amsdu size (bytes) per the HT spec */
+
+#define HT_PARAMS_RX_FACTOR_MASK	0x03	/* ampdu rcv factor mask */
+#define HT_PARAMS_DENSITY_MASK		0x1C	/* ampdu density mask */
+#define HT_PARAMS_DENSITY_SHIFT	2	/* ampdu density shift */
+
+/* HT/AMPDU specific define */
+#define AMPDU_MAX_MPDU_DENSITY  7       /* max mpdu density; in 1/4 usec units */
+#define AMPDU_DENSITY_NONE      0       /* No density requirement */
+#define AMPDU_DENSITY_1over4_US 1       /* 1/4 us density */
+#define AMPDU_DENSITY_1over2_US 2       /* 1/2 us density */
+#define AMPDU_DENSITY_1_US      3       /*   1 us density */
+#define AMPDU_DENSITY_2_US      4       /*   2 us density */
+#define AMPDU_DENSITY_4_US      5       /*   4 us density */
+#define AMPDU_DENSITY_8_US      6       /*   8 us density */
+#define AMPDU_DENSITY_16_US     7       /*  16 us density */
+#define AMPDU_RX_FACTOR_8K      0       /* max rcv ampdu len (8kb) */
+#define AMPDU_RX_FACTOR_16K     1       /* max rcv ampdu len (16kb) */
+#define AMPDU_RX_FACTOR_32K     2       /* max rcv ampdu len (32kb) */
+#define AMPDU_RX_FACTOR_64K     3       /* max rcv ampdu len (64kb) */
+#define AMPDU_RX_FACTOR_BASE    8*1024  /* ampdu factor base for rx len */
+
+#define AMPDU_DELIMITER_LEN	4	/* length of ampdu delimiter */
+#define AMPDU_DELIMITER_LEN_MAX	63	/* max length of ampdu delimiter(enforced in HW) */
+
+#define HT_CAP_EXT_PCO			0x0001
+#define HT_CAP_EXT_PCO_TTIME_MASK	0x0006
+#define HT_CAP_EXT_PCO_TTIME_SHIFT	1
+#define HT_CAP_EXT_MCS_FEEDBACK_MASK	0x0300
+#define HT_CAP_EXT_MCS_FEEDBACK_SHIFT	8
+#define HT_CAP_EXT_HTC			0x0400
+#define HT_CAP_EXT_RD_RESP		0x0800
 
 BWL_PRE_PACKED_STRUCT struct ht_add_ie {
-	uint8   ctl_ch;
-	uint8   byte1;
-	uint16  opmode;
-	uint16  misc_bits;
-	uint8   basic_mcs[MCSSET_LEN];
+	uint8	ctl_ch;			/* control channel number */
+	uint8	byte1;			/* ext ch,rec. ch. width, RIFS support */
+	uint16	opmode;			/* operation mode */
+	uint16	misc_bits;		/* misc bits */
+	uint8	basic_mcs[MCSSET_LEN];  /* required MCS set */
 } BWL_POST_PACKED_STRUCT;
 typedef struct ht_add_ie ht_add_ie_t;
 
-
-
+/* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the additional IE is primarily used to convey the current BSS configuration */
 BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
-	uint8   id;
-	uint8   len;
-	uint8   oui[3];
-	uint8   type;
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
+	uint8	type;		/* indicates what follows */
 	ht_add_ie_t add_ie;
 } BWL_POST_PACKED_STRUCT;
 typedef struct ht_prop_add_ie ht_prop_add_ie_t;
 
-#define HT_ADD_IE_LEN   22
-#define HT_ADD_IE_TYPE  52
-
-
-#define HT_BW_ANY       0x04
-#define HT_RIFS_PERMITTED       0x08
-
-
-#define HT_OPMODE_MASK          0x0003
-#define HT_OPMODE_SHIFT     0
-#define HT_OPMODE_PURE      0x0000
-#define HT_OPMODE_OPTIONAL  0x0001
-#define HT_OPMODE_HT20IN40  0x0002
-#define HT_OPMODE_MIXED 0x0003
-#define HT_OPMODE_NONGF 0x0004
-#define DOT11N_TXBURST      0x0008
-#define DOT11N_OBSS_NONHT   0x0010
-
-
-#define HT_BASIC_STBC_MCS   0x007f
-#define HT_DUAL_STBC_PROT   0x0080
-#define HT_SECOND_BCN       0x0100
-#define HT_LSIG_TXOP        0x0200
-#define HT_PCO_ACTIVE       0x0400
-#define HT_PCO_PHASE        0x0800
-
-
-#define DOT11N_2G_TXBURST_LIMIT 6160
-#define DOT11N_5G_TXBURST_LIMIT 3080
-
-
-#define GET_HT_OPMODE(add_ie)       ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+#define HT_ADD_IE_LEN	22
+#define HT_ADD_IE_TYPE	52
+
+/* byte1 defn's */
+#define HT_BW_ANY		0x04	/* set, STA can use 20 or 40MHz */
+#define HT_RIFS_PERMITTED     	0x08	/* RIFS allowed */
+
+/* opmode defn's */
+#define HT_OPMODE_MASK	        0x0003	/* protection mode mask */
+#define HT_OPMODE_SHIFT		0	/* protection mode shift */
+#define HT_OPMODE_PURE		0x0000	/* protection mode PURE */
+#define HT_OPMODE_OPTIONAL	0x0001	/* protection mode optional */
+#define HT_OPMODE_HT20IN40	0x0002	/* protection mode 20MHz HT in 40MHz BSS */
+#define HT_OPMODE_MIXED	0x0003	/* protection mode Mixed Mode */
+#define HT_OPMODE_NONGF	0x0004	/* protection mode non-GF */
+#define DOT11N_TXBURST		0x0008	/* Tx burst limit */
+#define DOT11N_OBSS_NONHT	0x0010	/* OBSS Non-HT STA present */
+
+/* misc_bites defn's */
+#define HT_BASIC_STBC_MCS	0x007f	/* basic STBC MCS */
+#define HT_DUAL_STBC_PROT	0x0080	/* Dual STBC Protection */
+#define HT_SECOND_BCN		0x0100	/* Secondary beacon support */
+#define HT_LSIG_TXOP		0x0200	/* L-SIG TXOP Protection full support */
+#define HT_PCO_ACTIVE		0x0400	/* PCO active */
+#define HT_PCO_PHASE		0x0800	/* PCO phase */
+#define HT_DUALCTS_PROTECTION	0x0080	/* DUAL CTS protection needed */
+
+/* Tx Burst Limits */
+#define DOT11N_2G_TXBURST_LIMIT	6160	/* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+#define DOT11N_5G_TXBURST_LIMIT	3080	/* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+
+/* Macros for opmode */
+#define GET_HT_OPMODE(add_ie)		((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
 					>> HT_OPMODE_SHIFT)
-#define HT_MIXEDMODE_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
-					== HT_OPMODE_MIXED)
-#define HT_HT20_PRESENT(add_ie) ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
-					== HT_OPMODE_HT20IN40)
-#define HT_OPTIONAL_PRESENT(add_ie) ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
-					== HT_OPMODE_OPTIONAL)
-#define HT_USE_PROTECTION(add_ie)   (HT_HT20_PRESENT((add_ie)) || \
-					HT_MIXEDMODE_PRESENT((add_ie)))
-#define HT_NONGF_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
-					== HT_OPMODE_NONGF)
-#define DOT11N_TXBURST_PRESENT(add_ie)  ((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
-					== DOT11N_TXBURST)
-#define DOT11N_OBSS_NONHT_PRESENT(add_ie)   ((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
-					== DOT11N_OBSS_NONHT)
+#define HT_MIXEDMODE_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					== HT_OPMODE_MIXED)	/* mixed mode present */
+#define HT_HT20_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					== HT_OPMODE_HT20IN40)	/* 20MHz HT present */
+#define HT_OPTIONAL_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					== HT_OPMODE_OPTIONAL)	/* Optional protection present */
+#define HT_USE_PROTECTION(add_ie)	(HT_HT20_PRESENT((add_ie)) || \
+					HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
+#define HT_NONGF_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
+					== HT_OPMODE_NONGF)	/* non-GF present */
+#define DOT11N_TXBURST_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
+					== DOT11N_TXBURST)	/* Tx Burst present */
+#define DOT11N_OBSS_NONHT_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
+					== DOT11N_OBSS_NONHT)	/* OBSS Non-HT present */
 
 BWL_PRE_PACKED_STRUCT struct obss_params {
-	uint16  passive_dwell;
-	uint16  active_dwell;
-	uint16  bss_widthscan_interval;
-	uint16  passive_total;
-	uint16  active_total;
-	uint16  chanwidth_transition_dly;
-	uint16  activity_threshold;
+	uint16	passive_dwell;
+	uint16	active_dwell;
+	uint16	bss_widthscan_interval;
+	uint16	passive_total;
+	uint16	active_total;
+	uint16	chanwidth_transition_dly;
+	uint16	activity_threshold;
 } BWL_POST_PACKED_STRUCT;
 typedef struct obss_params obss_params_t;
 
 BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
-	uint8   id;
-	uint8   len;
+	uint8	id;
+	uint8	len;
 	obss_params_t obss_params;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_obss_ie dot11_obss_ie_t;
-#define DOT11_OBSS_SCAN_IE_LEN  sizeof(obss_params_t)
-
-
-#define HT_CTRL_LA_TRQ      0x00000002
-#define HT_CTRL_LA_MAI      0x0000003C
-#define HT_CTRL_LA_MAI_SHIFT    2
-#define HT_CTRL_LA_MAI_MRQ  0x00000004
-#define HT_CTRL_LA_MAI_MSI  0x00000038
-#define HT_CTRL_LA_MFSI     0x000001C0
-#define HT_CTRL_LA_MFSI_SHIFT   6
-#define HT_CTRL_LA_MFB_ASELC    0x0000FE00
-#define HT_CTRL_LA_MFB_ASELC_SH 9
-#define HT_CTRL_LA_ASELC_CMD    0x00000C00
-#define HT_CTRL_LA_ASELC_DATA   0x0000F000
-#define HT_CTRL_CAL_POS     0x00030000
-#define HT_CTRL_CAL_SEQ     0x000C0000
-#define HT_CTRL_CSI_STEERING    0x00C00000
-#define HT_CTRL_CSI_STEER_SHIFT 22
-#define HT_CTRL_CSI_STEER_NFB   0
-#define HT_CTRL_CSI_STEER_CSI   1
-#define HT_CTRL_CSI_STEER_NCOM  2
-#define HT_CTRL_CSI_STEER_COM   3
-#define HT_CTRL_NDP_ANNOUNCE    0x01000000
-#define HT_CTRL_AC_CONSTRAINT   0x40000000
-#define HT_CTRL_RDG_MOREPPDU    0x80000000
-
-#define HT_OPMODE_OPTIONAL  0x0001
-#define HT_OPMODE_HT20IN40  0x0002
-#define HT_OPMODE_MIXED 0x0003
-#define HT_OPMODE_NONGF 0x0004
-#define DOT11N_TXBURST      0x0008
-#define DOT11N_OBSS_NONHT   0x0010
-
+#define DOT11_OBSS_SCAN_IE_LEN	sizeof(obss_params_t)	/* HT OBSS len (based on 802.11n d3.0) */
+
+/* HT control field */
+#define HT_CTRL_LA_TRQ		0x00000002	/* sounding request */
+#define HT_CTRL_LA_MAI		0x0000003C	/* MCS request or antenna selection indication */
+#define HT_CTRL_LA_MAI_SHIFT	2
+#define HT_CTRL_LA_MAI_MRQ	0x00000004	/* MCS request */
+#define HT_CTRL_LA_MAI_MSI	0x00000038	/* MCS request sequence identifier */
+#define HT_CTRL_LA_MFSI		0x000001C0	/* MFB sequence identifier */
+#define HT_CTRL_LA_MFSI_SHIFT	6
+#define HT_CTRL_LA_MFB_ASELC	0x0000FE00	/* MCS feedback, antenna selection command/data */
+#define HT_CTRL_LA_MFB_ASELC_SH	9
+#define HT_CTRL_LA_ASELC_CMD	0x00000C00	/* ASEL command */
+#define HT_CTRL_LA_ASELC_DATA	0x0000F000	/* ASEL data */
+#define HT_CTRL_CAL_POS		0x00030000	/* Calibration position */
+#define HT_CTRL_CAL_SEQ		0x000C0000	/* Calibration sequence */
+#define HT_CTRL_CSI_STEERING	0x00C00000	/* CSI/Steering */
+#define HT_CTRL_CSI_STEER_SHIFT	22
+#define HT_CTRL_CSI_STEER_NFB	0		/* no fedback required */
+#define HT_CTRL_CSI_STEER_CSI	1		/* CSI, H matrix */
+#define HT_CTRL_CSI_STEER_NCOM	2		/* non-compressed beamforming */
+#define HT_CTRL_CSI_STEER_COM	3		/* compressed beamforming */
+#define HT_CTRL_NDP_ANNOUNCE	0x01000000	/* NDP announcement */
+#define HT_CTRL_AC_CONSTRAINT	0x40000000	/* AC Constraint */
+#define HT_CTRL_RDG_MOREPPDU	0x80000000	/* RDG/More PPDU */
+
+#define HT_OPMODE_OPTIONAL	0x0001	/* protection mode optional */
+#define HT_OPMODE_HT20IN40	0x0002	/* protection mode 20MHz HT in 40MHz BSS */
+#define HT_OPMODE_MIXED	0x0003	/* protection mode Mixed Mode */
+#define HT_OPMODE_NONGF	0x0004	/* protection mode non-GF */
+#define DOT11N_TXBURST		0x0008	/* Tx burst limit */
+#define DOT11N_OBSS_NONHT	0x0010	/* OBSS Non-HT STA present */
+
+/* ************* VHT definitions. ************* */
 
+/*
+ * VHT Capabilites IE (sec 8.4.2.160)
+ */
 
-#define WPA_OUI         "\x00\x50\xF2"
-#define WPA_OUI_LEN     3
-#define WPA_OUI_TYPE        1
-#define WPA_VERSION     1
-#define WPA2_OUI        "\x00\x0F\xAC"
-#define WPA2_OUI_LEN        3
-#define WPA2_VERSION        1
-#define WPA2_VERSION_LEN    2
-
-
-#define WPS_OUI         "\x00\x50\xF2"
-#define WPS_OUI_LEN     3
-#define WPS_OUI_TYPE        4
-
-
-#define WFA_OUI         "\x50\x6F\x9A"
-#define WFA_OUI_LEN 3
-
-#define WFA_OUI_TYPE_WPA    1
-#define WFA_OUI_TYPE_WPS    4
-#define WFA_OUI_TYPE_TPC    8
-#define WFA_OUI_TYPE_P2P    9
-
-
-#define RSN_AKM_NONE        0
-#define RSN_AKM_UNSPECIFIED 1
-#define RSN_AKM_PSK     2
-#define RSN_AKM_FBT_1X      3
-#define RSN_AKM_FBT_PSK     4
-
-
-#define DOT11_MAX_DEFAULT_KEYS  4
-#define DOT11_MAX_KEY_SIZE  32
-#define DOT11_MAX_IV_SIZE   16
-#define DOT11_EXT_IV_FLAG   (1<<5)
-#define DOT11_WPA_KEY_RSC_LEN   8
-
-#define WEP1_KEY_SIZE       5
-#define WEP1_KEY_HEX_SIZE   10
-#define WEP128_KEY_SIZE     13
-#define WEP128_KEY_HEX_SIZE 26
-#define TKIP_MIC_SIZE       8
-#define TKIP_EOM_SIZE       7
-#define TKIP_EOM_FLAG       0x5a
-#define TKIP_KEY_SIZE       32
-#define TKIP_MIC_AUTH_TX    16
-#define TKIP_MIC_AUTH_RX    24
-#define TKIP_MIC_SUP_RX     TKIP_MIC_AUTH_TX
-#define TKIP_MIC_SUP_TX     TKIP_MIC_AUTH_RX
-#define AES_KEY_SIZE        16
-#define AES_MIC_SIZE        8
+BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
+	uint32  vht_cap_info;
+	/* supported MCS set - 64 bit field */
+	uint16	rx_mcs_map;
+	uint16  rx_max_rate;
+	uint16  tx_mcs_map;
+	uint16	tx_max_rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_cap_ie vht_cap_ie_t;
+
+/* 4B cap_info + 8B supp_mcs */
+#define VHT_CAP_IE_LEN 12
+
+/* VHT Capabilities Info field - 32bit - in VHT Cap IE */
+#define VHT_CAP_INFO_MAX_MPDU_LEN_MASK          0x00000003
+#define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK       0x0000000c
+#define VHT_CAP_INFO_LDPC                       0x00000010
+#define VHT_CAP_INFO_SGI_80MHZ                  0x00000020
+#define VHT_CAP_INFO_SGI_160MHZ                 0x00000040
+#define VHT_CAP_INFO_TX_STBC                    0x00000080
+#define VHT_CAP_INFO_RX_STBC_MASK               0x00000700
+#define VHT_CAP_INFO_RX_STBC_SHIFT              8
+#define VHT_CAP_INFO_SU_BEAMFMR                 0x00000800
+#define VHT_CAP_INFO_SU_BEAMFMEE                0x00001000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK         0x0000e000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT        13
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK      0x00070000
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT     16
+#define VHT_CAP_INFO_MU_BEAMFMR                 0x00080000
+#define VHT_CAP_INFO_MU_BEAMFMEE                0x00100000
+#define VHT_CAP_INFO_TXOPPS                     0x00200000
+#define VHT_CAP_INFO_HTCVHT                     0x00400000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK      0x03800000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT     23
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK        0x0c000000
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT       26
+
+/* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT  0
+
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT  0
+
+#define VHT_CAP_MCS_MAP_0_7                     0
+#define VHT_CAP_MCS_MAP_0_8                     1
+#define VHT_CAP_MCS_MAP_0_9                     2
+#define VHT_CAP_MCS_MAP_NONE                    3
+#define VHT_CAP_MCS_MAP_S                       2 /* num bits for 1-stream */
+#define VHT_CAP_MCS_MAP_M                       0x3 /* mask for 1-stream */
+/* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
+#define VHT_CAP_MCS_MAP_NONE_ALL                0xffff
+/* mcsmap with MCS0-9 for Nss = 3 */
+#define VHT_CAP_MCS_MAP_0_9_NSS3 \
+	        ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) | \
+	         (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) | \
+	         (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
+
+#define VHT_CAP_MCS_MAP_NSS_MAX                 8
+
+/* get mcsmap with given mcs for given nss streams */
+#define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs) \
+	do { \
+		int i; \
+		for (i = 1; i <= nss; i++) { \
+			VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap); \
+		} \
+	} while (0)
+
+/* Map the mcs code to mcs bit map */
+#define VHT_MCS_CODE_TO_MCS_MAP(mcs_code) \
+	((mcs_code == VHT_CAP_MCS_MAP_0_7) ? 0xff : \
+	 (mcs_code == VHT_CAP_MCS_MAP_0_8) ? 0x1ff : \
+	 (mcs_code == VHT_CAP_MCS_MAP_0_9) ? 0x3ff : 0)
+
+/* Map the mcs bit map to mcs code */
+#define VHT_MCS_MAP_TO_MCS_CODE(mcs_map) \
+	((mcs_map == 0xff)  ? VHT_CAP_MCS_MAP_0_7 : \
+	 (mcs_map == 0x1ff) ? VHT_CAP_MCS_MAP_0_8 : \
+	 (mcs_map == 0x3ff) ? VHT_CAP_MCS_MAP_0_9 : VHT_CAP_MCS_MAP_NONE)
+
+/* VHT Capabilities Supported Channel Width */
+typedef enum vht_cap_chan_width {
+	VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
+	VHT_CAP_CHAN_WIDTH_SUPPORT_160       = 0x04,
+	VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080  = 0x08
+} vht_cap_chan_width_t;
+
+/* VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
+typedef enum vht_cap_max_mpdu_len {
+	VHT_CAP_MPDU_MAX_4K     = 0x00,
+	VHT_CAP_MPDU_MAX_8K     = 0x01,
+	VHT_CAP_MPDU_MAX_11K    = 0x02
+} vht_cap_max_mpdu_len_t;
+
+/* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
+#define VHT_MPDU_LIMIT_4K        3895
+#define VHT_MPDU_LIMIT_8K        7991
+#define VHT_MPDU_LIMIT_11K      11454
 
 
-#define WCN_OUI         "\x00\x50\xf2"
-#define WCN_TYPE        4
+/*
+ * VHT Operation IE (sec 8.4.2.161)
+ */
 
+BWL_PRE_PACKED_STRUCT struct vht_op_ie {
+	uint8	chan_width;
+	uint8	chan1;
+	uint8	chan2;
+	uint16	supp_mcs;  /*  same def as above in vht cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_op_ie vht_op_ie_t;
 
+/* 3B VHT Op info + 2B Basic MCS */
+#define VHT_OP_IE_LEN 5
 
+typedef enum vht_op_chan_width {
+	VHT_OP_CHAN_WIDTH_20_40	= 0,
+	VHT_OP_CHAN_WIDTH_80	= 1,
+	VHT_OP_CHAN_WIDTH_160	= 2,
+	VHT_OP_CHAN_WIDTH_80_80	= 3
+} vht_op_chan_width_t;
 
+/* AID length */
+#define AID_IE_LEN		2
+/*
+ * BRCM vht features IE header
+ * The header if the fixed part of the IE
+ * On the 5GHz band this is the entire IE,
+ * on 2.4GHz the VHT IEs as defined in the 802.11ac
+ * specification follows
+ *
+ *
+ * VHT features rates  bitmap.
+ * Bit0:		5G MCS 0-9 BW 160MHz
+ * Bit1:		5G MCS 0-9 support BW 80MHz
+ * Bit2:		5G MCS 0-9 support BW 20MHz
+ * Bit3:		2.4G MCS 0-9 support BW 20MHz
+ * Bits:4-7	Reserved for future use
+ *
+ */
+#define VHT_FEATURES_IE_TYPE	0x4
+BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
+	uint8 oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
+	uint8 type;		/* type of this IE = 4 */
+	uint8 rate_mask;	/* VHT rate mask */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
+
+/* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
+#define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
+#define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap) \
+	(((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
+#define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap) \
+	do { \
+	 (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss))); \
+	 (mcsMap) |= (((numMcs) & VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss)); \
+	} while (0)
+#define VHT_MCS_SS_SUPPORTED(nss, mcsMap) \
+		 (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
+
+
+/* ************* WPA definitions. ************* */
+#define WPA_OUI			"\x00\x50\xF2"	/* WPA OUI */
+#define WPA_OUI_LEN		3		/* WPA OUI length */
+#define WPA_OUI_TYPE		1
+#define WPA_VERSION		1		/* WPA version */
+#define WPA2_OUI		"\x00\x0F\xAC"	/* WPA2 OUI */
+#define WPA2_OUI_LEN		3		/* WPA2 OUI length */
+#define WPA2_VERSION		1		/* WPA2 version */
+#define WPA2_VERSION_LEN	2		/* WAP2 version length */
+
+/* ************* WPS definitions. ************* */
+#define WPS_OUI			"\x00\x50\xF2"	/* WPS OUI */
+#define WPS_OUI_LEN		3		/* WPS OUI length */
+#define WPS_OUI_TYPE		4
+
+/* ************* WFA definitions. ************* */
+
+#ifdef P2P_IE_OVRD
+#define WFA_OUI			MAC_OUI
+#else
+#define WFA_OUI			"\x50\x6F\x9A"	/* WFA OUI */
+#endif /* P2P_IE_OVRD */
+#define WFA_OUI_LEN		3		/* WFA OUI length */
+#ifdef P2P_IE_OVRD
+#define WFA_OUI_TYPE_P2P	MAC_OUI_TYPE_P2P
+#else
+#define WFA_OUI_TYPE_TPC	8
+#define WFA_OUI_TYPE_P2P	9
+#endif
 
+#define WFA_OUI_TYPE_TPC	8
+#ifdef WLTDLS
+#define WFA_OUI_TYPE_TPQ	4	/* WFD Tunneled Probe ReQuest */
+#define WFA_OUI_TYPE_TPS	5	/* WFD Tunneled Probe ReSponse */
+#define WFA_OUI_TYPE_WFD	10
+#endif /* WTDLS */
+#define WFA_OUI_TYPE_HS20	0x10
+
+/* RSN authenticated key managment suite */
+#define RSN_AKM_NONE		0	/* None (IBSS) */
+#define RSN_AKM_UNSPECIFIED	1	/* Over 802.1x */
+#define RSN_AKM_PSK		2	/* Pre-shared Key */
+#define RSN_AKM_FBT_1X		3	/* Fast Bss transition using 802.1X */
+#define RSN_AKM_FBT_PSK		4	/* Fast Bss transition using Pre-shared Key */
+#define RSN_AKM_MFP_1X		5	/* SHA256 key derivation, using 802.1X */
+#define RSN_AKM_MFP_PSK		6	/* SHA256 key derivation, using Pre-shared Key */
+#define RSN_AKM_TPK			7	/* TPK(TDLS Peer Key) handshake */
+
+/* Key related defines */
+#define DOT11_MAX_DEFAULT_KEYS	4	/* number of default keys */
+#define DOT11_MAX_KEY_SIZE	32	/* max size of any key */
+#define DOT11_MAX_IV_SIZE	16	/* max size of any IV */
+#define DOT11_EXT_IV_FLAG	(1<<5)	/* flag to indicate IV is > 4 bytes */
+#define DOT11_WPA_KEY_RSC_LEN   8       /* WPA RSC key len */
+
+#define WEP1_KEY_SIZE		5	/* max size of any WEP key */
+#define WEP1_KEY_HEX_SIZE	10	/* size of WEP key in hex. */
+#define WEP128_KEY_SIZE		13	/* max size of any WEP key */
+#define WEP128_KEY_HEX_SIZE	26	/* size of WEP key in hex. */
+#define TKIP_MIC_SIZE		8	/* size of TKIP MIC */
+#define TKIP_EOM_SIZE		7	/* max size of TKIP EOM */
+#define TKIP_EOM_FLAG		0x5a	/* TKIP EOM flag byte */
+#define TKIP_KEY_SIZE		32	/* size of any TKIP key */
+#define TKIP_MIC_AUTH_TX	16	/* offset to Authenticator MIC TX key */
+#define TKIP_MIC_AUTH_RX	24	/* offset to Authenticator MIC RX key */
+#define TKIP_MIC_SUP_RX		TKIP_MIC_AUTH_TX	/* offset to Supplicant MIC RX key */
+#define TKIP_MIC_SUP_TX		TKIP_MIC_AUTH_RX	/* offset to Supplicant MIC TX key */
+#define AES_KEY_SIZE		16	/* size of AES key */
+#define AES_MIC_SIZE		8	/* size of AES MIC */
+#define BIP_KEY_SIZE		16	/* size of BIP key */
+#define BIP_MIC_SIZE		8   /* sizeof BIP MIC */
+
+/* WCN */
+#define WCN_OUI			"\x00\x50\xf2"	/* WCN OUI */
+#define WCN_TYPE		4	/* WCN type */
+
+
+/* 802.11r protocol definitions */
+
+/* Mobility Domain IE */
 BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
 	uint8 id;
 	uint8 len;
-	uint16 mdid;
+	uint16 mdid;		/* Mobility Domain Id */
 	uint8 cap;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_mdid_ie dot11_mdid_ie_t;
 
-#define FBT_MDID_CAP_OVERDS 0x01
-#define FBT_MDID_CAP_RRP    0x02
-
+#define FBT_MDID_CAP_OVERDS	0x01	/* Fast Bss transition over the DS support */
+#define FBT_MDID_CAP_RRP	0x02	/* Resource request protocol support */
 
+/* Fast Bss Transition IE */
 BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
 	uint8 id;
 	uint8 len;
-	uint16 mic_control;
+	uint16 mic_control;		/* Mic Control */
 	uint8 mic[16];
 	uint8 anonce[32];
 	uint8 snonce[32];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_ft_ie dot11_ft_ie_t;
 
+#define TIE_TYPE_RESERVED		0
+#define TIE_TYPE_REASSOC_DEADLINE	1
+#define TIE_TYPE_KEY_LIEFTIME		2
+#define TIE_TYPE_ASSOC_COMEBACK		3
+BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
+	uint8 id;
+	uint8 len;
+	uint8 type;		/* timeout interval type */
+	uint32 value;		/* timeout interval value */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timeout_ie dot11_timeout_ie_t;
 
+/* GTK ie */
 BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
 	uint8 id;
 	uint8 len;
@@ -1800,8 +3341,239 @@ BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_gtk_ie dot11_gtk_ie_t;
 
+/* Management MIC ie */
+BWL_PRE_PACKED_STRUCT struct mmic_ie {
+	uint8   id;					/* IE ID: 0xDD */
+	uint8   len;				/* IE length */
+	uint16  key_id;				/* key id */
+	uint8   ipn[6];				/* ipn */
+	uint8   mic[BIP_MIC_SIZE];	/* mic */
+} BWL_POST_PACKED_STRUCT;
+typedef struct mmic_ie mmic_ie_t;
+
+#define BSSID_INVALID           "\x00\x00\x00\x00\x00\x00"
+#define BSSID_BROADCAST         "\xFF\xFF\xFF\xFF\xFF\xFF"
 
 
+/* ************* WMM Parameter definitions. ************* */
+#define WMM_OUI			"\x00\x50\xF2"	/* WNN OUI */
+#define WMM_OUI_LEN		3		/* WMM OUI length */
+#define WMM_OUI_TYPE	2		/* WMM OUT type */
+#define WMM_VERSION		1
+#define WMM_VERSION_LEN	1
+
+/* WMM OUI subtype */
+#define WMM_OUI_SUBTYPE_PARAMETER	1
+#define WMM_PARAMETER_IE_LEN		24
+
+/* Link Identifier Element */
+BWL_PRE_PACKED_STRUCT struct link_id_ie {
+	uint8 id;
+	uint8 len;
+	struct ether_addr	bssid;
+	struct ether_addr	tdls_init_mac;
+	struct ether_addr	tdls_resp_mac;
+} BWL_POST_PACKED_STRUCT;
+typedef struct link_id_ie link_id_ie_t;
+#define TDLS_LINK_ID_IE_LEN		18
+
+/* Link Wakeup Schedule Element */
+BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
+	uint8 id;
+	uint8 len;
+	uint32 offset;			/* in ms between TSF0 and start of 1st Awake Window */
+	uint32 interval;		/* in ms bwtween the start of 2 Awake Windows */
+	uint32 awake_win_slots;	/* in backof slots, duration of Awake Window */
+	uint32 max_wake_win;	/* in ms, max duration of Awake Window */
+	uint16 idle_cnt;		/* number of consecutive Awake Windows */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wakeup_sch_ie wakeup_sch_ie_t;
+#define TDLS_WAKEUP_SCH_IE_LEN		18
+
+/* Channel Switch Timing Element */
+BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
+	uint8 id;
+	uint8 len;
+	uint16 switch_time;		/* in ms, time to switch channels */
+	uint16 switch_timeout;	/* in ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
+#define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN		4
+
+/* PTI Control Element */
+BWL_PRE_PACKED_STRUCT struct pti_control_ie {
+	uint8 id;
+	uint8 len;
+	uint8 tid;
+	uint16 seq_control;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pti_control_ie pti_control_ie_t;
+#define TDLS_PTI_CONTROL_IE_LEN		3
+
+/* PU Buffer Status Element */
+BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
+	uint8 id;
+	uint8 len;
+	uint8 status;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
+#define TDLS_PU_BUFFER_STATUS_IE_LEN	1
+#define TDLS_PU_BUFFER_STATUS_AC_BK		1
+#define TDLS_PU_BUFFER_STATUS_AC_BE		2
+#define TDLS_PU_BUFFER_STATUS_AC_VI		4
+#define TDLS_PU_BUFFER_STATUS_AC_VO		8
+
+/* 802.11u GAS action frames */
+#define GAS_REQUEST_ACTION_FRAME				10
+#define GAS_RESPONSE_ACTION_FRAME				11
+#define GAS_COMEBACK_REQUEST_ACTION_FRAME		12
+#define GAS_COMEBACK_RESPONSE_ACTION_FRAME		13
+
+/* 802.11u interworking access network options */
+#define IW_ANT_MASK				0x0f
+#define IW_INTERNET_MASK		0x10
+#define IW_ASRA_MASK			0x20
+#define IW_ESR_MASK				0x40
+#define IW_UESA_MASK			0x80
+
+/* 802.11u interworking access network type */
+#define IW_ANT_PRIVATE_NETWORK					0
+#define IW_ANT_PRIVATE_NETWORK_WITH_GUEST		1
+#define IW_ANT_CHARGEABLE_PUBLIC_NETWORK		2
+#define IW_ANT_FREE_PUBLIC_NETWORK				3
+#define IW_ANT_PERSONAL_DEVICE_NETWORK			4
+#define IW_ANT_EMERGENCY_SERVICES_NETWORK		5
+#define IW_ANT_TEST_NETWORK						14
+#define IW_ANT_WILDCARD_NETWORK					15
+
+/* 802.11u advertisement protocol */
+#define ADVP_ANQP_PROTOCOL_ID	0
+
+/* 802.11u advertisement protocol masks */
+#define ADVP_QRL_MASK					0x7f
+#define ADVP_PAME_BI_MASK				0x80
+
+/* 802.11u advertisement protocol values */
+#define ADVP_QRL_REQUEST				0x00
+#define ADVP_QRL_RESPONSE				0x7f
+#define ADVP_PAME_BI_DEPENDENT			0x00
+#define ADVP_PAME_BI_INDEPENDENT		ADVP_PAME_BI_MASK
+
+/* 802.11u ANQP information ID */
+#define ANQP_ID_QUERY_LIST							256
+#define ANQP_ID_CAPABILITY_LIST						257
+#define ANQP_ID_VENUE_NAME_INFO						258
+#define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO			259
+#define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO	260
+#define ANQP_ID_ROAMING_CONSORTIUM_LIST				261
+#define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO	262
+#define ANQP_ID_NAI_REALM_LIST						263
+#define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO			264
+#define ANQP_ID_AP_GEOSPATIAL_LOCATION				265
+#define ANQP_ID_AP_CIVIC_LOCATION					266
+#define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI			267
+#define ANQP_ID_DOMAIN_NAME_LIST					268
+#define ANQP_ID_EMERGENCY_ALERT_ID_URI				269
+#define ANQP_ID_EMERGENCY_NAI						271
+#define ANQP_ID_VENDOR_SPECIFIC_LIST				56797
+
+/* 802.11u ANQP OUI */
+#define ANQP_OUI_SUBTYPE	9
+
+/* 802.11u venue name */
+#define VENUE_LANGUAGE_CODE_SIZE		3
+#define VENUE_NAME_SIZE					255
+
+/* 802.11u venue groups */
+#define VENUE_UNSPECIFIED				0
+#define VENUE_ASSEMBLY					1
+#define VENUE_BUSINESS					2
+#define VENUE_EDUCATIONAL				3
+#define VENUE_FACTORY					4
+#define VENUE_INSTITUTIONAL				5
+#define VENUE_MERCANTILE				6
+#define VENUE_RESIDENTIAL				7
+#define VENUE_STORAGE					8
+#define VENUE_UTILITY					9
+#define VENUE_VEHICULAR					10
+#define VENUE_OUTDOOR					11
+
+/* 802.11u network authentication type indicator */
+#define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS			0
+#define NATI_ONLINE_ENROLLMENT_SUPPORTED			1
+#define NATI_HTTP_HTTPS_REDIRECTION					2
+#define NATI_DNS_REDIRECTION						3
+
+/* 802.11u IP address type availability - IPv6 */
+#define IPA_IPV6_SHIFT						0
+#define IPA_IPV6_MASK						(0x03 << IPA_IPV6_SHIFT)
+#define	IPA_IPV6_NOT_AVAILABLE				0x00
+#define IPA_IPV6_AVAILABLE					0x01
+#define IPA_IPV6_UNKNOWN_AVAILABILITY		0x02
+
+/* 802.11u IP address type availability - IPv4 */
+#define IPA_IPV4_SHIFT						2
+#define IPA_IPV4_MASK						(0x3f << IPA_IPV4_SHIFT)
+#define	IPA_IPV4_NOT_AVAILABLE				0x00
+#define IPA_IPV4_PUBLIC						0x01
+#define IPA_IPV4_PORT_RESTRICT				0x02
+#define IPA_IPV4_SINGLE_NAT					0x03
+#define IPA_IPV4_DOUBLE_NAT					0x04
+#define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT	0x05
+#define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT	0x06
+#define IPA_IPV4_UNKNOWN_AVAILABILITY		0x07
+
+/* 802.11u NAI realm encoding */
+#define REALM_ENCODING_RFC4282	0
+#define REALM_ENCODING_UTF8		1
+
+/* 802.11u IANA EAP method type numbers */
+#define REALM_EAP_TLS					13
+#define REALM_EAP_SIM					18
+#define REALM_EAP_TTLS					21
+#define REALM_EAP_AKA					23
+#define REALM_EAP_PSK					47
+#define REALM_EAP_AKAP					50
+
+/* 802.11u authentication ID */
+#define REALM_EXPANDED_EAP						1
+#define REALM_NON_EAP_INNER_AUTHENTICATION		2
+#define REALM_INNER_AUTHENTICATION_EAP			3
+#define REALM_EXPANDED_INNER_EAP				4
+#define REALM_CREDENTIAL						5
+#define REALM_TUNNELED_EAP_CREDENTIAL			6
+#define REALM_VENDOR_SPECIFIC_EAP				221
+
+/* 802.11u non-EAP inner authentication type */
+#define REALM_PAP					1
+#define REALM_CHAP					2
+#define REALM_MSCHAP				3
+#define REALM_MSCHAPV2				4
+
+/* 802.11u credential type */
+#define REALM_SIM					1
+#define REALM_USIM					2
+#define REALM_NFC					3
+#define REALM_HARDWARE_TOKEN		4
+#define REALM_SOFTOKEN				5
+#define REALM_CERTIFICATE			6
+#define REALM_USERNAME_PASSWORD		7
+#define REALM_SERVER_SIDE			8
+
+/* 802.11u 3GPP PLMN */
+#define G3PP_GUD_VERSION		0
+#define G3PP_PLMN_LIST_IE		0
+
+/* hotspot2.0 indication element (vendor specific) */
+BWL_PRE_PACKED_STRUCT struct hs20_ie {
+	uint8 oui[3];
+	uint8 type;
+	uint8 config;
+} BWL_POST_PACKED_STRUCT;
+typedef struct hs20_ie hs20_ie_t;
+#define HS20_IE_LEN 5	/* HS20 IE length */
+
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
-#endif
+#endif /* _802_11_H_ */
diff --git a/bcmdhd/dhdutil/include/proto/802.11_bta.h b/bcmdhd/dhdutil/include/proto/802.11_bta.h
new file mode 100644
index 0000000..3a65287
--- /dev/null
+++ b/bcmdhd/dhdutil/include/proto/802.11_bta.h
@@ -0,0 +1,39 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) 802.11 PAL (Protocol Adaptation Layer)
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: 802.11_bta.h 382882 2013-02-04 23:24:31Z $
+*/
+
+#ifndef _802_11_BTA_H_
+#define _802_11_BTA_H_
+
+#define BT_SIG_SNAP_MPROT		"\xAA\xAA\x03\x00\x19\x58"
+
+/* BT-AMP 802.11 PAL Protocols */
+#define BTA_PROT_L2CAP				1
+#define	BTA_PROT_ACTIVITY_REPORT		2
+#define BTA_PROT_SECURITY			3
+#define BTA_PROT_LINK_SUPERVISION_REQUEST	4
+#define BTA_PROT_LINK_SUPERVISION_REPLY		5
+
+/* BT-AMP 802.11 PAL AMP_ASSOC Type IDs */
+#define BTA_TYPE_ID_MAC_ADDRESS			1
+#define BTA_TYPE_ID_PREFERRED_CHANNELS		2
+#define BTA_TYPE_ID_CONNECTED_CHANNELS		3
+#define BTA_TYPE_ID_CAPABILITIES		4
+#define BTA_TYPE_ID_VERSION			5
+#endif /* _802_11_bta_h_ */
diff --git a/bcmdhd/dhdutil/include/proto/802.11e.h b/bcmdhd/dhdutil/include/proto/802.11e.h
new file mode 100644
index 0000000..48e2506
--- /dev/null
+++ b/bcmdhd/dhdutil/include/proto/802.11e.h
@@ -0,0 +1,126 @@
+/*
+ * 802.11e protocol header file
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: 802.11e.h 382883 2013-02-04 23:26:09Z $
+ */
+
+#ifndef _802_11e_H_
+#define _802_11e_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WME Traffic Specification (TSPEC) element */
+#define WME_TSPEC_HDR_LEN           2           /* WME TSPEC header length */
+#define WME_TSPEC_BODY_OFF          2           /* WME TSPEC body offset */
+
+#define WME_CATEGORY_CODE_OFFSET	0		/* WME Category code offset */
+#define WME_ACTION_CODE_OFFSET		1		/* WME Action code offset */
+#define WME_TOKEN_CODE_OFFSET		2		/* WME Token code offset */
+#define WME_STATUS_CODE_OFFSET		3		/* WME Status code offset */
+
+BWL_PRE_PACKED_STRUCT struct tsinfo {
+	uint8 octets[3];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct tsinfo tsinfo_t;
+
+/* 802.11e TSPEC IE */
+typedef BWL_PRE_PACKED_STRUCT struct tspec {
+	uint8 oui[DOT11_OUI_LEN];	/* WME_OUI */
+	uint8 type;					/* WME_TYPE */
+	uint8 subtype;				/* WME_SUBTYPE_TSPEC */
+	uint8 version;				/* WME_VERSION */
+	tsinfo_t tsinfo;			/* TS Info bit field */
+	uint16 nom_msdu_size;		/* (Nominal or fixed) MSDU Size (bytes) */
+	uint16 max_msdu_size;		/* Maximum MSDU Size (bytes) */
+	uint32 min_srv_interval;	/* Minimum Service Interval (us) */
+	uint32 max_srv_interval;	/* Maximum Service Interval (us) */
+	uint32 inactivity_interval;	/* Inactivity Interval (us) */
+	uint32 suspension_interval; /* Suspension Interval (us) */
+	uint32 srv_start_time;		/* Service Start Time (us) */
+	uint32 min_data_rate;		/* Minimum Data Rate (bps) */
+	uint32 mean_data_rate;		/* Mean Data Rate (bps) */
+	uint32 peak_data_rate;		/* Peak Data Rate (bps) */
+	uint32 max_burst_size;		/* Maximum Burst Size (bytes) */
+	uint32 delay_bound;			/* Delay Bound (us) */
+	uint32 min_phy_rate;		/* Minimum PHY Rate (bps) */
+	uint16 surplus_bw;			/* Surplus Bandwidth Allowance (range 1.0-8.0) */
+	uint16 medium_time;			/* Medium Time (32 us/s periods) */
+} BWL_POST_PACKED_STRUCT tspec_t;
+
+#define WME_TSPEC_LEN	(sizeof(tspec_t))		/* not including 2-bytes of header */
+
+/* ts_info */
+/* 802.1D priority is duplicated - bits 13-11 AND bits 3-1 */
+#define TS_INFO_TID_SHIFT		1	/* TS info. TID shift */
+#define TS_INFO_TID_MASK		(0xf << TS_INFO_TID_SHIFT)	/* TS info. TID mask */
+#define TS_INFO_CONTENTION_SHIFT	7	/* TS info. contention shift */
+#define TS_INFO_CONTENTION_MASK	(0x1 << TS_INFO_CONTENTION_SHIFT) /* TS info. contention mask */
+#define TS_INFO_DIRECTION_SHIFT	5	/* TS info. direction shift */
+#define TS_INFO_DIRECTION_MASK	(0x3 << TS_INFO_DIRECTION_SHIFT) /* TS info. direction mask */
+#define TS_INFO_PSB_SHIFT		2		/* TS info. PSB bit Shift */
+#define TS_INFO_PSB_MASK		(1 << TS_INFO_PSB_SHIFT)	/* TS info. PSB mask */
+#define TS_INFO_UPLINK			(0 << TS_INFO_DIRECTION_SHIFT)	/* TS info. uplink */
+#define TS_INFO_DOWNLINK		(1 << TS_INFO_DIRECTION_SHIFT)	/* TS info. downlink */
+#define TS_INFO_BIDIRECTIONAL	(3 << TS_INFO_DIRECTION_SHIFT)	/* TS info. bidirectional */
+#define TS_INFO_USER_PRIO_SHIFT	3	/* TS info. user priority shift */
+/* TS info. user priority mask */
+#define TS_INFO_USER_PRIO_MASK	(0x7 << TS_INFO_USER_PRIO_SHIFT)
+
+/* Macro to get/set bit(s) field in TSINFO */
+#define WLC_CAC_GET_TID(pt)	((((pt).octets[0]) & TS_INFO_TID_MASK) >> TS_INFO_TID_SHIFT)
+#define WLC_CAC_GET_DIR(pt)	((((pt).octets[0]) & \
+	TS_INFO_DIRECTION_MASK) >> TS_INFO_DIRECTION_SHIFT)
+#define WLC_CAC_GET_PSB(pt)	((((pt).octets[1]) & TS_INFO_PSB_MASK) >> TS_INFO_PSB_SHIFT)
+#define WLC_CAC_GET_USER_PRIO(pt)	((((pt).octets[1]) & \
+	TS_INFO_USER_PRIO_MASK) >> TS_INFO_USER_PRIO_SHIFT)
+
+#define WLC_CAC_SET_TID(pt, id)	((((pt).octets[0]) & (~TS_INFO_TID_MASK)) | \
+	((id) << TS_INFO_TID_SHIFT))
+#define WLC_CAC_SET_USER_PRIO(pt, prio)	((((pt).octets[0]) & (~TS_INFO_USER_PRIO_MASK)) | \
+	((prio) << TS_INFO_USER_PRIO_SHIFT))
+
+/* 802.11e QBSS Load IE */
+#define QBSS_LOAD_IE_LEN		5	/* QBSS Load IE length */
+#define QBSS_LOAD_AAC_OFF		3	/* AAC offset in IE */
+
+#define CAC_ADDTS_RESP_TIMEOUT		1000	/* default ADDTS response timeout in ms */
+						/* DEFVAL dot11ADDTSResponseTimeout = 1s */
+
+/* 802.11e ADDTS status code */
+#define DOT11E_STATUS_ADMISSION_ACCEPTED	0	/* TSPEC Admission accepted status */
+#define DOT11E_STATUS_ADDTS_INVALID_PARAM	1	/* TSPEC invalid parameter status */
+#define DOT11E_STATUS_ADDTS_REFUSED_NSBW	3	/* ADDTS refused (non-sufficient BW) */
+#define DOT11E_STATUS_ADDTS_REFUSED_AWHILE	47	/* ADDTS refused but could retry later */
+
+/* 802.11e DELTS status code */
+#define DOT11E_STATUS_QSTA_LEAVE_QBSS		36	/* STA leave QBSS */
+#define DOT11E_STATUS_END_TS				37	/* END TS */
+#define DOT11E_STATUS_UNKNOWN_TS			38	/* UNKNOWN TS */
+#define DOT11E_STATUS_QSTA_REQ_TIMEOUT		39	/* STA ADDTS request timeout */
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11e_CAC_H_ */
diff --git a/bcmdhd/dhdutil/include/proto/802.1d.h b/bcmdhd/dhdutil/include/proto/802.1d.h
index dbf3a1c..6792278 100644
--- a/bcmdhd/dhdutil/include/proto/802.1d.h
+++ b/bcmdhd/dhdutil/include/proto/802.1d.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,29 +15,30 @@
  *
  * Fundamental types and constants relating to 802.1D
  *
- * $Id: 802.1d.h,v 9.3 2007-04-10 21:33:06 Exp $
+ * $Id: 802.1d.h 382882 2013-02-04 23:24:31Z $
  */
 
-
 #ifndef _802_1_D_
 #define _802_1_D_
 
-
-#define	PRIO_8021D_NONE		2
-#define	PRIO_8021D_BK		1
-#define	PRIO_8021D_BE		0
-#define	PRIO_8021D_EE		3
-#define	PRIO_8021D_CL		4
-#define	PRIO_8021D_VI		5
-#define	PRIO_8021D_VO		6
-#define	PRIO_8021D_NC		7
-#define	MAXPRIO			7
+/* 802.1D priority defines */
+#define	PRIO_8021D_NONE		2	/* None = - */
+#define	PRIO_8021D_BK		1	/* BK - Background */
+#define	PRIO_8021D_BE		0	/* BE - Best-effort */
+#define	PRIO_8021D_EE		3	/* EE - Excellent-effort */
+#define	PRIO_8021D_CL		4	/* CL - Controlled Load */
+#define	PRIO_8021D_VI		5	/* Vi - Video */
+#define	PRIO_8021D_VO		6	/* Vo - Voice */
+#define	PRIO_8021D_NC		7	/* NC - Network Control */
+#define	MAXPRIO			7	/* 0-7 */
 #define NUMPRIO			(MAXPRIO + 1)
 
-#define ALLPRIO		-1
-
+#define ALLPRIO		-1	/* All prioirty */
 
+/* Converts prio to precedence since the numerical value of
+ * PRIO_8021D_BE and PRIO_8021D_NONE are swapped.
+ */
 #define PRIO2PREC(prio) \
 	(((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? ((prio^2)) : (prio))
 
-#endif
+#endif /* _802_1_D__ */
diff --git a/bcmdhd/dhdutil/include/proto/802.3.h b/bcmdhd/dhdutil/include/proto/802.3.h
new file mode 100644
index 0000000..8c0080f
--- /dev/null
+++ b/bcmdhd/dhdutil/include/proto/802.3.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Fundamental constants relating to 802.3
+ *
+ * $Id: 802.3.h 382882 2013-02-04 23:24:31Z $
+ */
+
+#ifndef _802_3_h_
+#define _802_3_h_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define SNAP_HDR_LEN	6	/* 802.3 SNAP header length */
+#define DOT3_OUI_LEN	3	/* 802.3 oui length */
+
+BWL_PRE_PACKED_STRUCT struct dot3_mac_llc_snap_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];	/* dest mac */
+	uint8	ether_shost[ETHER_ADDR_LEN];	/* src mac */
+	uint16	length;				/* frame length incl header */
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[DOT3_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
+						 * Bridge-Tunnel: 0x00 0x00 0xF8
+						 */
+	uint16	type;				/* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif	/* #ifndef _802_3_h_ */
diff --git a/bcmdhd/dhdutil/include/proto/bcmeth.h b/bcmdhd/dhdutil/include/proto/bcmeth.h
index 06ca18f..f430c9d 100644
--- a/bcmdhd/dhdutil/include/proto/bcmeth.h
+++ b/bcmdhd/dhdutil/include/proto/bcmeth.h
@@ -1,8 +1,8 @@
 /*
  * Broadcom Ethernettype  protocol definitions
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,11 +15,12 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmeth.h,v 9.12 2009-12-29 19:57:18 Exp $
+ * $Id: bcmeth.h 382882 2013-02-04 23:24:31Z $
  */
 
-
-
+/*
+ * Broadcom Ethernet protocol defines
+ */
 
 #ifndef _BCMETH_H_
 #define _BCMETH_H_
@@ -28,14 +29,39 @@
 #include <typedefs.h>
 #endif
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
+/* ETHER_TYPE_BRCM is defined in ethernet.h */
 
+/*
+ * Following the 2byte BRCM ether_type is a 16bit BRCM subtype field
+ * in one of two formats: (only subtypes 32768-65535 are in use now)
+ *
+ * subtypes 0-32767:
+ *     8 bit subtype (0-127)
+ *     8 bit length in bytes (0-255)
+ *
+ * subtypes 32768-65535:
+ *     16 bit big-endian subtype
+ *     16 bit big-endian length in bytes (0-65535)
+ *
+ * length is the number of additional bytes beyond the 4 or 6 byte header
+ *
+ * Reserved values:
+ * 0 reserved
+ * 5-15 reserved for iLine protocol assignments
+ * 17-126 reserved, assignable
+ * 127 reserved
+ * 32768 reserved
+ * 32769-65534 reserved, assignable
+ * 65535 reserved
+ */
 
-
-
-
+/*
+ * While adding the subtypes and their specific processing code make sure
+ * bcmeth_bcm_hdr_t is the first data structure in the user specific data structure definition
+ */
 
 #define	BCMILCP_SUBTYPE_RATE		1
 #define	BCMILCP_SUBTYPE_LINK		2
@@ -52,26 +78,29 @@
 #define BCMILCP_BCM_SUBTYPE_RESERVED		0
 #define BCMILCP_BCM_SUBTYPE_EVENT		1
 #define BCMILCP_BCM_SUBTYPE_SES			2
-
-
+/*
+ * The EAPOL type is not used anymore. Instead EAPOL messages are now embedded
+ * within BCMILCP_BCM_SUBTYPE_EVENT type messages
+ */
+/* #define BCMILCP_BCM_SUBTYPE_EAPOL		3 */
 #define BCMILCP_BCM_SUBTYPE_DPT			4
 
 #define BCMILCP_BCM_SUBTYPEHDR_MINLENGTH	8
 #define BCMILCP_BCM_SUBTYPEHDR_VERSION		0
 
-
+/* These fields are stored in network order */
 typedef BWL_PRE_PACKED_STRUCT struct bcmeth_hdr
 {
-	uint16	subtype;
+	uint16	subtype;	/* Vendor specific..32769 */
 	uint16	length;
-	uint8	version;
-	uint8	oui[3];
-
+	uint8	version;	/* Version is 0 */
+	uint8	oui[3];		/* Broadcom OUI */
+	/* user specific Data */
 	uint16	usr_subtype;
 } BWL_POST_PACKED_STRUCT bcmeth_hdr_t;
 
 
-
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
-#endif
+#endif	/*  _BCMETH_H_ */
diff --git a/bcmdhd/dhdutil/include/proto/bcmevent.h b/bcmdhd/dhdutil/include/proto/bcmevent.h
index 6fecc0f..50fbacd 100644
--- a/bcmdhd/dhdutil/include/proto/bcmevent.h
+++ b/bcmdhd/dhdutil/include/proto/bcmevent.h
@@ -1,8 +1,8 @@
 /*
  * Broadcom Event  protocol definitions
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -17,12 +17,14 @@
  *
  * Dependencies: proto/bcmeth.h
  *
- * $Id: bcmevent.h 326276 2012-04-06 23:16:42Z $
+ * $Id: bcmevent.h 386716 2013-02-21 18:16:10Z $
  *
  */
 
-
-
+/*
+ * Broadcom Ethernet Events protocol defines
+ *
+ */
 
 #ifndef _BCMEVENT_H_
 #define _BCMEVENT_H_
@@ -30,163 +32,195 @@
 #ifndef _TYPEDEFS_H_
 #include <typedefs.h>
 #endif
+/* #include <ethernet.h> -- TODO: req., excluded to overwhelming coupling (break up ethernet.h) */
+#include <proto/bcmeth.h>
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
-#define BCM_EVENT_MSG_VERSION		2
-#define BCM_MSG_IFNAME_MAX		16
-
-
-#define WLC_EVENT_MSG_LINK		0x01
-#define WLC_EVENT_MSG_FLUSHTXQ		0x02
-#define WLC_EVENT_MSG_GROUP		0x04
-#define WLC_EVENT_MSG_UNKBSS		0x08
-#define WLC_EVENT_MSG_UNKIF		0x10
-
+#define BCM_EVENT_MSG_VERSION		2	/* wl_event_msg_t struct version */
+#define BCM_MSG_IFNAME_MAX		16	/* max length of interface name */
 
+/* flags */
+#define WLC_EVENT_MSG_LINK		0x01	/* link is up */
+#define WLC_EVENT_MSG_FLUSHTXQ		0x02	/* flush tx queue on MIC error */
+#define WLC_EVENT_MSG_GROUP		0x04	/* group MIC error */
+#define WLC_EVENT_MSG_UNKBSS		0x08	/* unknown source bsscfg */
+#define WLC_EVENT_MSG_UNKIF		0x10	/* unknown source OS i/f */
 
+/* these fields are stored in network order */
 
+/* version 1 */
 typedef BWL_PRE_PACKED_STRUCT struct
 {
 	uint16	version;
-	uint16	flags;
-	uint32	event_type;
-	uint32	status;
-	uint32	reason;
-	uint32	auth_type;
-	uint32	datalen;
-	struct ether_addr	addr;
-	char	ifname[BCM_MSG_IFNAME_MAX];
+	uint16	flags;			/* see flags below */
+	uint32	event_type;		/* Message (see below) */
+	uint32	status;			/* Status code (see below) */
+	uint32	reason;			/* Reason code (if applicable) */
+	uint32	auth_type;		/* WLC_E_AUTH */
+	uint32	datalen;		/* data buf */
+	struct ether_addr	addr;	/* Station address (if applicable) */
+	char	ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
 } BWL_POST_PACKED_STRUCT wl_event_msg_v1_t;
 
-
+/* the current version */
 typedef BWL_PRE_PACKED_STRUCT struct
 {
 	uint16	version;
-	uint16	flags;
-	uint32	event_type;
-	uint32	status;
-	uint32	reason;
-	uint32	auth_type;
-	uint32	datalen;
-	struct ether_addr	addr;
-	char	ifname[BCM_MSG_IFNAME_MAX];
-	uint8	ifidx;
-	uint8	bsscfgidx;
+	uint16	flags;			/* see flags below */
+	uint32	event_type;		/* Message (see below) */
+	uint32	status;			/* Status code (see below) */
+	uint32	reason;			/* Reason code (if applicable) */
+	uint32	auth_type;		/* WLC_E_AUTH */
+	uint32	datalen;		/* data buf */
+	struct ether_addr	addr;	/* Station address (if applicable) */
+	char	ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+	uint8	ifidx;			/* destination OS i/f index */
+	uint8	bsscfgidx;		/* source bsscfg index */
 } BWL_POST_PACKED_STRUCT wl_event_msg_t;
 
-
+/* used by driver msgs */
 typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
 	struct ether_header eth;
 	bcmeth_hdr_t		bcm_hdr;
 	wl_event_msg_t		event;
-
+	/* data portion follows */
 } BWL_POST_PACKED_STRUCT bcm_event_t;
 
 #define BCM_MSG_LEN	(sizeof(bcm_event_t) - sizeof(bcmeth_hdr_t) - sizeof(struct ether_header))
 
-
-#define WLC_E_SET_SSID		0
-#define WLC_E_JOIN		1
-#define WLC_E_START		2
-#define WLC_E_AUTH		3
-#define WLC_E_AUTH_IND		4
-#define WLC_E_DEAUTH		5
-#define WLC_E_DEAUTH_IND	6
-#define WLC_E_ASSOC		7
-#define WLC_E_ASSOC_IND		8
-#define WLC_E_REASSOC		9
-#define WLC_E_REASSOC_IND	10
-#define WLC_E_DISASSOC		11
-#define WLC_E_DISASSOC_IND	12
-#define WLC_E_QUIET_START	13
-#define WLC_E_QUIET_END		14
-#define WLC_E_BEACON_RX		15
-#define WLC_E_LINK		16
-#define WLC_E_MIC_ERROR		17
-#define WLC_E_NDIS_LINK		18
-#define WLC_E_ROAM		19
-#define WLC_E_TXFAIL		20
-#define WLC_E_PMKID_CACHE	21
-#define WLC_E_RETROGRADE_TSF	22
-#define WLC_E_PRUNE		23
-#define WLC_E_AUTOAUTH		24
-#define WLC_E_EAPOL_MSG		25
-#define WLC_E_SCAN_COMPLETE	26
-#define WLC_E_ADDTS_IND		27
-#define WLC_E_DELTS_IND		28
-#define WLC_E_BCNSENT_IND	29
-#define WLC_E_BCNRX_MSG		30
-#define WLC_E_BCNLOST_MSG	31
-#define WLC_E_ROAM_PREP		32
-#define WLC_E_PFN_NET_FOUND	33
-#define WLC_E_PFN_NET_LOST	34
+/* Event messages */
+#define WLC_E_SET_SSID		0	/* indicates status of set SSID */
+#define WLC_E_JOIN		1	/* differentiates join IBSS from found (WLC_E_START) IBSS */
+#define WLC_E_START		2	/* STA founded an IBSS or AP started a BSS */
+#define WLC_E_AUTH		3	/* 802.11 AUTH request */
+#define WLC_E_AUTH_IND		4	/* 802.11 AUTH indication */
+#define WLC_E_DEAUTH		5	/* 802.11 DEAUTH request */
+#define WLC_E_DEAUTH_IND	6	/* 802.11 DEAUTH indication */
+#define WLC_E_ASSOC		7	/* 802.11 ASSOC request */
+#define WLC_E_ASSOC_IND		8	/* 802.11 ASSOC indication */
+#define WLC_E_REASSOC		9	/* 802.11 REASSOC request */
+#define WLC_E_REASSOC_IND	10	/* 802.11 REASSOC indication */
+#define WLC_E_DISASSOC		11	/* 802.11 DISASSOC request */
+#define WLC_E_DISASSOC_IND	12	/* 802.11 DISASSOC indication */
+#define WLC_E_QUIET_START	13	/* 802.11h Quiet period started */
+#define WLC_E_QUIET_END		14	/* 802.11h Quiet period ended */
+#define WLC_E_BEACON_RX		15	/* BEACONS received/lost indication */
+#define WLC_E_LINK		16	/* generic link indication */
+#define WLC_E_MIC_ERROR		17	/* TKIP MIC error occurred */
+#define WLC_E_NDIS_LINK		18	/* NDIS style link indication */
+#define WLC_E_ROAM		19	/* roam attempt occurred: indicate status & reason */
+#define WLC_E_TXFAIL		20	/* change in dot11FailedCount (txfail) */
+#define WLC_E_PMKID_CACHE	21	/* WPA2 pmkid cache indication */
+#define WLC_E_RETROGRADE_TSF	22	/* current AP's TSF value went backward */
+#define WLC_E_PRUNE		23	/* AP was pruned from join list for reason */
+#define WLC_E_AUTOAUTH		24	/* report AutoAuth table entry match for join attempt */
+#define WLC_E_EAPOL_MSG		25	/* Event encapsulating an EAPOL message */
+#define WLC_E_SCAN_COMPLETE	26	/* Scan results are ready or scan was aborted */
+#define WLC_E_ADDTS_IND		27	/* indicate to host addts fail/success */
+#define WLC_E_DELTS_IND		28	/* indicate to host delts fail/success */
+#define WLC_E_BCNSENT_IND	29	/* indicate to host of beacon transmit */
+#define WLC_E_BCNRX_MSG		30	/* Send the received beacon up to the host */
+#define WLC_E_BCNLOST_MSG	31	/* indicate to host loss of beacon */
+#define WLC_E_ROAM_PREP		32	/* before attempting to roam */
+#define WLC_E_PFN_NET_FOUND	33	/* PFN network found event */
+#define WLC_E_PFN_NET_LOST	34	/* PFN network lost event */
 #define WLC_E_RESET_COMPLETE	35
 #define WLC_E_JOIN_START	36
 #define WLC_E_ROAM_START	37
 #define WLC_E_ASSOC_START	38
 #define WLC_E_IBSS_ASSOC	39
 #define WLC_E_RADIO		40
-#define WLC_E_PSM_WATCHDOG	41
-#define WLC_E_PROBREQ_MSG       44
+#define WLC_E_PSM_WATCHDOG	41	/* PSM microcode watchdog fired */
+#define WLC_E_PROBREQ_MSG       44      /* probe request received */
 #define WLC_E_SCAN_CONFIRM_IND  45
-#define WLC_E_PSK_SUP		46
-#define WLC_E_COUNTRY_CODE_CHANGED 47
-#define	WLC_E_EXCEEDED_MEDIUM_TIME 48
-#define WLC_E_ICV_ERROR		49
-#define WLC_E_UNICAST_DECODE_ERROR 50
-#define WLC_E_MULTICAST_DECODE_ERROR 51
+#define WLC_E_PSK_SUP		46	/* WPA Handshake fail */
+#define WLC_E_COUNTRY_CODE_CHANGED	47
+#define	WLC_E_EXCEEDED_MEDIUM_TIME	48	/* WMMAC excedded medium time */
+#define WLC_E_ICV_ERROR		49	/* WEP ICV error occurred */
+#define WLC_E_UNICAST_DECODE_ERROR	50	/* Unsupported unicast encrypted frame */
+#define WLC_E_MULTICAST_DECODE_ERROR	51	/* Unsupported multicast encrypted frame */
 #define WLC_E_TRACE		52
-#ifdef WLBTAMP
-#define WLC_E_BTA_HCI_EVENT	53	
-#endif
-#define WLC_E_IF		54	
-#define WLC_E_P2P_DISC_LISTEN_COMPLETE	55	
-#define WLC_E_RSSI		56
-#define WLC_E_PFN_SCAN_COMPLETE	57
+#define WLC_E_IF		54	/* I/F change (for dongle host notification) */
+#define WLC_E_P2P_DISC_LISTEN_COMPLETE	55	/* listen state expires */
+#define WLC_E_RSSI		56	/* indicate RSSI change based on configured levels */
+#define WLC_E_PFN_SCAN_COMPLETE	57	/* PFN completed scan of network list */
 #define WLC_E_EXTLOG_MSG	58
-#define WLC_E_ACTION_FRAME      59
-#define WLC_E_ACTION_FRAME_COMPLETE 60
-#define WLC_E_PRE_ASSOC_IND	61
-#define WLC_E_PRE_REASSOC_IND	62
+#define WLC_E_ACTION_FRAME      59 	/* Action frame Rx */
+#define WLC_E_ACTION_FRAME_COMPLETE	60	/* Action frame Tx complete */
+#define WLC_E_PRE_ASSOC_IND	61	/* assoc request received */
+#define WLC_E_PRE_REASSOC_IND	62	/* re-assoc request received */
 #define WLC_E_CHANNEL_ADOPTED	63
-#define WLC_E_AP_STARTED	64
-#define WLC_E_DFS_AP_STOP	65
-#define WLC_E_DFS_AP_RESUME	66
-#define WLC_E_WAI_STA_EVENT	67
-#define WLC_E_WAI_MSG 		68
-#define WLC_E_ESCAN_RESULT 	69
-#define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE 	70
-#define WLC_E_PROBRESP_MSG	71
-#define WLC_E_P2P_PROBREQ_MSG	72
-#define WLC_E_DCS_REQUEST 73
-
-#define WLC_E_FIFO_CREDIT_MAP	74
-
-#define WLC_E_ACTION_FRAME_RX	75
-#define WLC_E_WAKE_EVENT	76
-#define WLC_E_RM_COMPLETE	77
-#define WLC_E_HTSFSYNC		78
-#define WLC_E_OVERLAY_REQ	79
-#define WLC_E_CSA_COMPLETE_IND  80
-#define WLC_E_EXCESS_PM_WAKE_EVENT	81
-#define WLC_E_PFN_SCAN_NONE		82
-#define WLC_E_PFN_SCAN_ALLGONE	83
-#define WLC_E_GTK_PLUMBED 		84
-#define WLC_E_ASSOC_IND_NDIS		85	
-#define WLC_E_REASSOC_IND_NDIS		86	
-#define WLC_E_ASSOC_REQ_IE 		87
-#define WLC_E_ASSOC_RESP_IE 		88
-#define WLC_E_ASSOC_RECREATED	89	
-#define WLC_E_ACTION_FRAME_RX_NDIS	90	
-#define WLC_E_AUTH_REQ		91	
-#define WLC_E_TDLS_PEER_EVENT 	92	
-#define WLC_E_SPEEDY_RECREATE_FAIL	93	
-#define WLC_E_LAST			94	
-
-
-
+#define WLC_E_AP_STARTED	64	/* AP started */
+#define WLC_E_DFS_AP_STOP	65	/* AP stopped due to DFS */
+#define WLC_E_DFS_AP_RESUME	66	/* AP resumed due to DFS */
+#define WLC_E_WAI_STA_EVENT	67	/* WAI stations event */
+#define WLC_E_WAI_MSG 		68	/* event encapsulating an WAI message */
+#define WLC_E_ESCAN_RESULT 	69	/* escan result event */
+#define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE 	70	/* action frame off channel complete */
+#define WLC_E_PROBRESP_MSG	71	/* probe response received */
+#define WLC_E_P2P_PROBREQ_MSG	72	/* P2P Probe request received */
+#define WLC_E_DCS_REQUEST	73
+#define WLC_E_FIFO_CREDIT_MAP	74	/* credits for D11 FIFOs. [AC0,AC1,AC2,AC3,BC_MC,ATIM] */
+#define WLC_E_ACTION_FRAME_RX	75	/* Received action frame event WITH
+					 * wl_event_rx_frame_data_t header
+					 */
+#define WLC_E_WAKE_EVENT	76	/* Wake Event timer fired, used for wake WLAN test mode */
+#define WLC_E_RM_COMPLETE	77	/* Radio measurement complete */
+#define WLC_E_HTSFSYNC		78	/* Synchronize TSF with the host */
+#define WLC_E_OVERLAY_REQ	79	/* request an overlay IOCTL/iovar from the host */
+#define WLC_E_CSA_COMPLETE_IND		80	/* 802.11 CHANNEL SWITCH ACTION completed */
+#define WLC_E_EXCESS_PM_WAKE_EVENT	81	/* excess PM Wake Event to inform host  */
+#define WLC_E_PFN_SCAN_NONE		82	/* no PFN networks around */
+#define WLC_E_PFN_SCAN_ALLGONE		83	/* last found PFN network gets lost */
+#define WLC_E_GTK_PLUMBED		84
+#define WLC_E_ASSOC_IND_NDIS		85	/* 802.11 ASSOC indication for NDIS only */
+#define WLC_E_REASSOC_IND_NDIS		86	/* 802.11 REASSOC indication for NDIS only */
+#define WLC_E_ASSOC_REQ_IE		87
+#define WLC_E_ASSOC_RESP_IE		88
+#define WLC_E_ASSOC_RECREATED		89	/* association recreated on resume */
+#define WLC_E_ACTION_FRAME_RX_NDIS	90	/* rx action frame event for NDIS only */
+#define WLC_E_AUTH_REQ			91	/* authentication request received */
+#define WLC_E_TDLS_PEER_EVENT		92	/* discovered peer, connected/disconnected peer */
+#define WLC_E_SPEEDY_RECREATE_FAIL	93	/* fast assoc recreation failed */
+#define WLC_E_NATIVE			94	/* port-specific event and payload (e.g. NDIS) */
+#define WLC_E_PKTDELAY_IND		95	/* event for tx pkt delay suddently jump */
+#define WLC_E_AWDL_AW			96	/* AWDL AW period starts */
+#define WLC_E_AWDL_ROLE			97	/* AWDL Master/Slave/NE master role event */
+#define WLC_E_AWDL_EVENT		98	/* Generic AWDL event */
+#ifdef WLNIC
+#define WLC_E_NIC_AF_TXS		99	/* NIC AF txstatus */
+#define WLC_E_NIC_NIC_REPORT		100	/* NIC period report */
+#endif
+#define WLC_E_BEACON_FRAME_RX		101
+#define WLC_E_SERVICE_FOUND		102	/* desired service found */
+#define WLC_E_GAS_FRAGMENT_RX		103	/* GAS fragment received */
+#define WLC_E_GAS_COMPLETE		104	/* GAS sessions all complete */
+#define WLC_E_P2PO_ADD_DEVICE		105	/* New device found by p2p offload */
+#define WLC_E_P2PO_DEL_DEVICE		106	/* device has been removed by p2p offload */
+#define WLC_E_WNM_STA_SLEEP		107	/* WNM event to notify STA enter sleep mode */
+#define WLC_E_NONE			108	/* event removed, free to be reused */
+#define WLC_E_PROXD			109	/* Proximity Detection event */
+#define WLC_E_IBSS_COALESCE		110	/* IBSS Coalescing */
+#define WLC_E_AWDL_AW_EXT_END		111	/* AWDL extended period ends */
+#define WLC_E_AWDL_AW_EXT_START		112	/* SWDL AW extension start */
+#define WLC_E_AWDL_AW_START		113	/* AWDL start Event to inform host  */
+#define WLC_E_AWDL_RADIO_OFF		114	/* Radio Off  */
+#define WLC_E_AWDL_PEER_STATE		115	/* AWDL peer state open/close */
+#define WLC_E_AWDL_SYNC_STATE_CHANGED	116	/* AWDL sync role changed */
+#define WLC_E_AWDL_CHIP_RESET		117	/* infroms the interface of a chip rest */
+#define WLC_E_AWDL_INTERLEAVED_SCAN_START		118
+#define WLC_E_AWDL_INTERLEAVED_SCAN_STOP		119
+#define WLC_E_AWDL_PEER_CACHE_CONTROL			120
+#define WLC_E_CSA_START_IND		121
+#define WLC_E_CSA_DONE_IND		122
+#define WLC_E_CSA_FAILURE_IND		123
+#define WLC_E_CCA_CHAN_QUAL		124	/* CCA based channel quality report */
+#define WLC_E_LAST			125	/* highest val + 1 for range checking */
+
+
+/* Table of event name strings for UIs and debugging dumps */
 typedef struct {
 	uint event;
 	const char *name;
@@ -195,81 +229,93 @@ typedef struct {
 extern const bcmevent_name_t	bcmevent_names[];
 extern const int		bcmevent_names_size;
 
+/* Event status codes */
+#define WLC_E_STATUS_SUCCESS		0	/* operation was successful */
+#define WLC_E_STATUS_FAIL		1	/* operation failed */
+#define WLC_E_STATUS_TIMEOUT		2	/* operation timed out */
+#define WLC_E_STATUS_NO_NETWORKS	3	/* failed due to no matching network found */
+#define WLC_E_STATUS_ABORT		4	/* operation was aborted */
+#define WLC_E_STATUS_NO_ACK		5	/* protocol failure: packet not ack'd */
+#define WLC_E_STATUS_UNSOLICITED	6	/* AUTH or ASSOC packet was unsolicited */
+#define WLC_E_STATUS_ATTEMPT		7	/* attempt to assoc to an auto auth configuration */
+#define WLC_E_STATUS_PARTIAL		8	/* scan results are incomplete */
+#define WLC_E_STATUS_NEWSCAN		9	/* scan aborted by another scan */
+#define WLC_E_STATUS_NEWASSOC		10	/* scan aborted due to assoc in progress */
+#define WLC_E_STATUS_11HQUIET		11	/* 802.11h quiet period started */
+#define WLC_E_STATUS_SUPPRESS		12	/* user disabled scanning (WLC_SET_SCANSUPPRESS) */
+#define WLC_E_STATUS_NOCHANS		13	/* no allowable channels to scan */
+#define WLC_E_STATUS_CS_ABORT		15	/* abort channel select */
+#define WLC_E_STATUS_ERROR		16	/* request failed due to error */
+
+/* roam reason codes */
+#define WLC_E_REASON_INITIAL_ASSOC	0	/* initial assoc */
+#define WLC_E_REASON_LOW_RSSI		1	/* roamed due to low RSSI */
+#define WLC_E_REASON_DEAUTH		2	/* roamed due to DEAUTH indication */
+#define WLC_E_REASON_DISASSOC		3	/* roamed due to DISASSOC indication */
+#define WLC_E_REASON_BCNS_LOST		4	/* roamed due to lost beacons */
+
+/* Roam codes used primarily by CCX */
+#define WLC_E_REASON_FAST_ROAM_FAILED	5	/* roamed due to fast roam failure */
+#define WLC_E_REASON_DIRECTED_ROAM	6	/* roamed due to request by AP */
+#define WLC_E_REASON_TSPEC_REJECTED	7	/* roamed due to TSPEC rejection */
+#define WLC_E_REASON_BETTER_AP		8	/* roamed due to finding better AP */
+#define WLC_E_REASON_MINTXRATE		9	/* roamed because at mintxrate for too long */
+#define WLC_E_REASON_TXFAIL		10	/* We can hear AP, but AP can't hear us */
+
+#define WLC_E_REASON_REQUESTED_ROAM 11	/* roamed due to BSS Mgmt Transition request by AP */
+
+
+/* prune reason codes */
+#define WLC_E_PRUNE_ENCR_MISMATCH	1	/* encryption mismatch */
+#define WLC_E_PRUNE_BCAST_BSSID		2	/* AP uses a broadcast BSSID */
+#define WLC_E_PRUNE_MAC_DENY		3	/* STA's MAC addr is in AP's MAC deny list */
+#define WLC_E_PRUNE_MAC_NA		4	/* STA's MAC addr is not in AP's MAC allow list */
+#define WLC_E_PRUNE_REG_PASSV		5	/* AP not allowed due to regulatory restriction */
+#define WLC_E_PRUNE_SPCT_MGMT		6	/* AP does not support STA locale spectrum mgmt */
+#define WLC_E_PRUNE_RADAR		7	/* AP is on a radar channel of STA locale */
+#define WLC_E_RSN_MISMATCH		8	/* STA does not support AP's RSN */
+#define WLC_E_PRUNE_NO_COMMON_RATES	9	/* No rates in common with AP */
+#define WLC_E_PRUNE_BASIC_RATES		10	/* STA does not support all basic rates of BSS */
+#define WLC_E_PRUNE_CIPHER_NA		12	/* BSS's cipher not supported */
+#define WLC_E_PRUNE_KNOWN_STA		13	/* AP is already known to us as a STA */
+#define WLC_E_PRUNE_WDS_PEER		15	/* AP is already known to us as a WDS peer */
+#define WLC_E_PRUNE_QBSS_LOAD		16	/* QBSS LOAD - AAC is too low */
+#define WLC_E_PRUNE_HOME_AP		17	/* prune home AP */
+
+/* WPA failure reason codes carried in the WLC_E_PSK_SUP event */
+#define WLC_E_SUP_OTHER			0	/* Other reason */
+#define WLC_E_SUP_DECRYPT_KEY_DATA	1	/* Decryption of key data failed */
+#define WLC_E_SUP_BAD_UCAST_WEP128	2	/* Illegal use of ucast WEP128 */
+#define WLC_E_SUP_BAD_UCAST_WEP40	3	/* Illegal use of ucast WEP40 */
+#define WLC_E_SUP_UNSUP_KEY_LEN		4	/* Unsupported key length */
+#define WLC_E_SUP_PW_KEY_CIPHER		5	/* Unicast cipher mismatch in pairwise key */
+#define WLC_E_SUP_MSG3_TOO_MANY_IE	6	/* WPA IE contains > 1 RSN IE in key msg 3 */
+#define WLC_E_SUP_MSG3_IE_MISMATCH	7	/* WPA IE mismatch in key message 3 */
+#define WLC_E_SUP_NO_INSTALL_FLAG	8	/* INSTALL flag unset in 4-way msg */
+#define WLC_E_SUP_MSG3_NO_GTK		9	/* encapsulated GTK missing from msg 3 */
+#define WLC_E_SUP_GRP_KEY_CIPHER	10	/* Multicast cipher mismatch in group key */
+#define WLC_E_SUP_GRP_MSG1_NO_GTK	11	/* encapsulated GTK missing from group msg 1 */
+#define WLC_E_SUP_GTK_DECRYPT_FAIL	12	/* GTK decrypt failure */
+#define WLC_E_SUP_SEND_FAIL		13	/* message send failure */
+#define WLC_E_SUP_DEAUTH		14	/* received FC_DEAUTH */
+#define WLC_E_SUP_WPA_PSK_TMO		15	/* WPA PSK 4-way handshake timeout */
+
+/* Event data for events that include frames received over the air */
+/* WLC_E_PROBRESP_MSG
+ * WLC_E_P2P_PROBREQ_MSG
+ * WLC_E_ACTION_FRAME_RX
+ */
+#ifdef WLAWDL
+#define WLC_E_AWDL_SCAN_START		1	/* Scan start indication to host */
+#define WLC_E_AWDL_SCAN_DONE		0	/* Scan Done indication to host */
 
-#define WLC_E_STATUS_SUCCESS		0
-#define WLC_E_STATUS_FAIL		1
-#define WLC_E_STATUS_TIMEOUT		2
-#define WLC_E_STATUS_NO_NETWORKS	3
-#define WLC_E_STATUS_ABORT		4
-#define WLC_E_STATUS_NO_ACK		5
-#define WLC_E_STATUS_UNSOLICITED	6
-#define WLC_E_STATUS_ATTEMPT		7
-#define WLC_E_STATUS_PARTIAL		8
-#define WLC_E_STATUS_NEWSCAN		9
-#define WLC_E_STATUS_NEWASSOC		10
-#define WLC_E_STATUS_11HQUIET		11
-#define WLC_E_STATUS_SUPPRESS		12
-#define WLC_E_STATUS_NOCHANS		13
-#define WLC_E_STATUS_CS_ABORT		15
-#define WLC_E_STATUS_ERROR		16
-
-
-#define WLC_E_REASON_INITIAL_ASSOC	0
-#define WLC_E_REASON_LOW_RSSI		1
-#define WLC_E_REASON_DEAUTH		2
-#define WLC_E_REASON_DISASSOC		3
-#define WLC_E_REASON_BCNS_LOST		4
-#define WLC_E_REASON_MINTXRATE		9
-#define WLC_E_REASON_TXFAIL		10
-
-
-#define WLC_E_REASON_FAST_ROAM_FAILED	5
-#define WLC_E_REASON_DIRECTED_ROAM	6
-#define WLC_E_REASON_TSPEC_REJECTED	7
-#define WLC_E_REASON_BETTER_AP		8
-
-
-#define WLC_E_REASON_REQUESTED_ROAM 11	
-
-#define WLC_E_PRUNE_ENCR_MISMATCH	1
-#define WLC_E_PRUNE_BCAST_BSSID		2
-#define WLC_E_PRUNE_MAC_DENY		3
-#define WLC_E_PRUNE_MAC_NA		4
-#define WLC_E_PRUNE_REG_PASSV		5
-#define WLC_E_PRUNE_SPCT_MGMT		6
-#define WLC_E_PRUNE_RADAR		7
-#define WLC_E_RSN_MISMATCH		8
-#define WLC_E_PRUNE_NO_COMMON_RATES	9
-#define WLC_E_PRUNE_BASIC_RATES		10
-#define WLC_E_PRUNE_CIPHER_NA		12
-#define WLC_E_PRUNE_KNOWN_STA		13
-#define WLC_E_PRUNE_WDS_PEER		15
-#define WLC_E_PRUNE_QBSS_LOAD		16
-#define WLC_E_PRUNE_HOME_AP		17
-
-
-#define WLC_E_SUP_OTHER			0
-#define WLC_E_SUP_DECRYPT_KEY_DATA	1
-#define WLC_E_SUP_BAD_UCAST_WEP128	2
-#define WLC_E_SUP_BAD_UCAST_WEP40	3
-#define WLC_E_SUP_UNSUP_KEY_LEN		4
-#define WLC_E_SUP_PW_KEY_CIPHER		5
-#define WLC_E_SUP_MSG3_TOO_MANY_IE	6
-#define WLC_E_SUP_MSG3_IE_MISMATCH	7
-#define WLC_E_SUP_NO_INSTALL_FLAG	8
-#define WLC_E_SUP_MSG3_NO_GTK		9
-#define WLC_E_SUP_GRP_KEY_CIPHER	10
-#define WLC_E_SUP_GRP_MSG1_NO_GTK	11
-#define WLC_E_SUP_GTK_DECRYPT_FAIL	12
-#define WLC_E_SUP_SEND_FAIL		13
-#define WLC_E_SUP_DEAUTH		14
-#define WLC_E_SUP_WPA_PSK_TMO		15
-
-
+#define WLC_E_AWDL_RX_ACT_FRAME					1
+#define WLC_E_AWDL_RX_PRB_RESP					2
 
+#endif
 typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data {
 	uint16	version;
-	uint16	channel;
+	uint16	channel;	/* Matches chanspec_t format from bcmwifi_channels.h */
 	int32	rssi;
 	uint32	mactime;
 	uint32	rate;
@@ -277,46 +323,113 @@ typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data {
 
 #define BCM_RX_FRAME_DATA_VERSION 1
 
-
+/* WLC_E_IF event data */
 typedef struct wl_event_data_if {
-	uint8 ifidx;
-	uint8 opcode;
-	uint8 reserved;
-	uint8 bssidx;
-	uint8 role;
+	uint8 ifidx;		/* RTE virtual device index (for dongle) */
+	uint8 opcode;		/* see I/F opcode */
+	uint8 reserved;		/* bit mask (WLC_E_IF_FLAGS_XXX ) */
+	uint8 bssidx;		/* bsscfg index */
+	uint8 role;		/* see I/F role */
 } wl_event_data_if_t;
 
-
-#define WLC_E_IF_ADD		1
-#define WLC_E_IF_DEL		2
-#define WLC_E_IF_CHANGE		3
-
-
-#define WLC_E_IF_ROLE_STA		0
-#define WLC_E_IF_ROLE_AP		1
-#define WLC_E_IF_ROLE_WDS		2
-#define WLC_E_IF_ROLE_P2P_GO		3
-#define WLC_E_IF_ROLE_P2P_CLIENT	4
-#ifdef WLBTAMP
-#define WLC_E_IF_ROLE_BTA_CREATOR	5	
-#define WLC_E_IF_ROLE_BTA_ACCEPTOR	6	
-#endif
-
-
-#define WLC_E_LINK_BCN_LOSS	1	
-#define WLC_E_LINK_DISASSOC	2	
-#define WLC_E_LINK_ASSOC_REC	3	
-#define WLC_E_LINK_BSSCFG_DIS	4	
-
-
-#define WLC_E_OVL_DOWNLOAD		0	
-#define WLC_E_OVL_UPDATE_IND	1	
-
-
-#define WLC_E_TDLS_PEER_DISCOVERED		0	
+/* opcode in WLC_E_IF event */
+#define WLC_E_IF_ADD		1	/* bsscfg add */
+#define WLC_E_IF_DEL		2	/* bsscfg delete */
+#define WLC_E_IF_CHANGE		3	/* bsscfg role change */
+
+/* I/F role code in WLC_E_IF event */
+#define WLC_E_IF_ROLE_STA		0	/* Infra STA */
+#define WLC_E_IF_ROLE_AP		1	/* Access Point */
+#define WLC_E_IF_ROLE_WDS		2	/* WDS link */
+#define WLC_E_IF_ROLE_P2P_GO		3	/* P2P Group Owner */
+#define WLC_E_IF_ROLE_P2P_CLIENT	4	/* P2P Client */
+
+/* WLC_E_RSSI event data */
+typedef struct wl_event_data_rssi {
+	int32 rssi;
+	int32 snr;
+	int32 noise;
+} wl_event_data_rssi_t;
+
+/* WLC_E_IF flag */
+#define WLC_E_IF_FLAGS_BSSCFG_NOIF	0x1	/* no host I/F creation needed */
+
+/* Reason codes for LINK */
+#define WLC_E_LINK_BCN_LOSS	1	/* Link down because of beacon loss */
+#define WLC_E_LINK_DISASSOC	2	/* Link down because of disassoc */
+#define WLC_E_LINK_ASSOC_REC	3	/* Link down because assoc recreate failed */
+#define WLC_E_LINK_BSSCFG_DIS	4	/* Link down due to bsscfg down */
+
+/* reason codes for WLC_E_OVERLAY_REQ event */
+#define WLC_E_OVL_DOWNLOAD		0	/* overlay download request */
+#define WLC_E_OVL_UPDATE_IND	1	/* device indication of host overlay update */
+
+/* reason codes for WLC_E_TDLS_PEER_EVENT event */
+#define WLC_E_TDLS_PEER_DISCOVERED		0	/* peer is ready to establish TDLS */
 #define WLC_E_TDLS_PEER_CONNECTED		1
 #define WLC_E_TDLS_PEER_DISCONNECTED	2
 
+#ifdef WLAWDL
+/* WLC_E_AWDL_EVENT subtypes */
+#define WLC_E_AWDL_SCAN_STATUS	0
+#define WLC_E_AWDL_RX_ACT_FRAME	1
+#define WLC_E_AWDL_RX_PRB_RESP	2
+#define WLC_E_AWDL_PHYCAL_STATUS	3
+#define WLC_E_AWDL_WOWL_NULLPKT	4
+#define WLC_E_AWDL_OOB_AF_STATUS	5
+
+/* WLC_E_AWDL_SCAN_STATUS status values */
+#define WLC_E_AWDL_SCAN_START		1	/* Scan start indication to host */
+#define WLC_E_AWDL_SCAN_DONE		0	/* Scan Done indication to host */
+#define WLC_E_AWDL_PHYCAL_START		1	/* Phy calibration start indication to host */
+#define WLC_E_AWDL_PHYCAL_DONE		0	/* Phy calibration done indication to host */
+#endif
+
+/* GAS event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_gas {
+	uint16	channel;		/* channel of GAS protocol */
+	uint8	dialog_token;	/* GAS dialog token */
+	uint8	fragment_id;	/* fragment id */
+	uint16	status_code;	/* status code on GAS completion */
+	uint16 	data_len;		/* length of data to follow */
+	uint8	data[1];		/* variable length specified by data_len */
+} BWL_POST_PACKED_STRUCT wl_event_gas_t;
+
+/* service discovery TLV */
+typedef BWL_PRE_PACKED_STRUCT struct wl_sd_tlv {
+	uint16	length;			/* length of response_data */
+	uint8	protocol;		/* service protocol type */
+	uint8	transaction_id;		/* service transaction id */
+	uint8	status_code;		/* status code */
+	uint8	data[1];		/* response data */
+} BWL_POST_PACKED_STRUCT wl_sd_tlv_t;
+
+/* service discovery event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_sd {
+	uint16	channel;		/* channel */
+	uint8	count;			/* number of tlvs */
+	wl_sd_tlv_t	tlv[1];		/* service discovery TLV */
+} BWL_POST_PACKED_STRUCT wl_event_sd_t;
+
+/* Reason codes for WLC_E_PROXD */
+#define WLC_E_PROXD_FOUND	1	/* Found a proximity device */
+#define WLC_E_PROXD_GONE	2	/* Lost a proximity device */
+
+/* WLC_E_AWDL_AW event data */
+typedef BWL_PRE_PACKED_STRUCT struct awdl_aws_event_data {
+	uint32	fw_time;			/* firmware PMU time */
+	struct	ether_addr current_master;	/* Current master Mac addr */
+	uint16	aw_counter;			/* AW seq# */
+	uint8	aw_ext_count;			/* AW extension count */
+	uint8	aw_role;			/* AW role */
+	uint8	flags;				/* AW event flag */
+	uint16	aw_chan;
+} BWL_POST_PACKED_STRUCT awdl_aws_event_data_t;
+
+/* For awdl_aws_event_data_t.flags */
+#define AWDL_AW_LAST_EXT	0x01
+
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
-#endif
+#endif /* _BCMEVENT_H_ */
diff --git a/bcmdhd/dhdutil/include/proto/bcmip.h b/bcmdhd/dhdutil/include/proto/bcmip.h
index 8b58da1..abd7ff5 100644
--- a/bcmdhd/dhdutil/include/proto/bcmip.h
+++ b/bcmdhd/dhdutil/include/proto/bcmip.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,10 +15,9 @@
  *
  * Fundamental constants relating to IP Protocol
  *
- * $Id: bcmip.h 290206 2011-10-17 19:13:51Z $
+ * $Id: bcmip.h 384540 2013-02-12 04:28:58Z $
  */
 
-
 #ifndef _bcmip_h_
 #define _bcmip_h_
 
@@ -26,45 +25,46 @@
 #include <typedefs.h>
 #endif
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
 
-
-#define IP_VER_OFFSET		0x0
-#define IP_VER_MASK		0xf0
-#define IP_VER_SHIFT		4
-#define IP_VER_4		4
-#define IP_VER_6		6
+/* IPV4 and IPV6 common */
+#define IP_VER_OFFSET		0x0	/* offset to version field */
+#define IP_VER_MASK		0xf0	/* version mask */
+#define IP_VER_SHIFT		4	/* version shift */
+#define IP_VER_4		4	/* version number for IPV4 */
+#define IP_VER_6		6	/* version number for IPV6 */
 
 #define IP_VER(ip_body) \
 	((((uint8 *)(ip_body))[IP_VER_OFFSET] & IP_VER_MASK) >> IP_VER_SHIFT)
 
-#define IP_PROT_ICMP		0x1
-#define IP_PROT_IGMP		0x2	
-#define IP_PROT_TCP		0x6	
-#define IP_PROT_UDP		0x11	
-#define IP_PROT_ICMP6		0x3a	
-
-
-#define IPV4_VER_HL_OFFSET	0
-#define IPV4_TOS_OFFSET		1
-#define IPV4_PKTLEN_OFFSET	2
-#define IPV4_PKTFLAG_OFFSET	6
-#define IPV4_PROT_OFFSET	9
-#define IPV4_CHKSUM_OFFSET	10
-#define IPV4_SRC_IP_OFFSET	12
-#define IPV4_DEST_IP_OFFSET	16
-#define IPV4_OPTIONS_OFFSET	20
-
-
-#define IPV4_VER_MASK		0xf0
-#define IPV4_VER_SHIFT		4
-
-#define IPV4_HLEN_MASK		0x0f
+#define IP_PROT_ICMP		0x1	/* ICMP protocol */
+#define IP_PROT_IGMP		0x2	/* IGMP protocol */
+#define IP_PROT_TCP		0x6	/* TCP protocol */
+#define IP_PROT_UDP		0x11	/* UDP protocol type */
+#define IP_PROT_ICMP6		0x3a	/* ICMPv6 protocol type */
+
+/* IPV4 field offsets */
+#define IPV4_VER_HL_OFFSET      0       /* version and ihl byte offset */
+#define IPV4_TOS_OFFSET         1       /* type of service offset */
+#define IPV4_PKTLEN_OFFSET      2       /* packet length offset */
+#define IPV4_PKTFLAG_OFFSET     6       /* more-frag,dont-frag flag offset */
+#define IPV4_PROT_OFFSET        9       /* protocol type offset */
+#define IPV4_CHKSUM_OFFSET      10      /* IP header checksum offset */
+#define IPV4_SRC_IP_OFFSET      12      /* src IP addr offset */
+#define IPV4_DEST_IP_OFFSET     16      /* dest IP addr offset */
+#define IPV4_OPTIONS_OFFSET     20      /* IP options offset */
+#define IPV4_MIN_HEADER_LEN     20      /* Minimum size for an IP header (no options) */
+
+/* IPV4 field decodes */
+#define IPV4_VER_MASK		0xf0	/* IPV4 version mask */
+#define IPV4_VER_SHIFT		4	/* IPV4 version shift */
+
+#define IPV4_HLEN_MASK		0x0f	/* IPV4 header length mask */
 #define IPV4_HLEN(ipv4_body)	(4 * (((uint8 *)(ipv4_body))[IPV4_VER_HL_OFFSET] & IPV4_HLEN_MASK))
 
-#define IPV4_ADDR_LEN		4
+#define IPV4_ADDR_LEN		4	/* IPV4 address length */
 
 #define IPV4_ADDR_NULL(a)	((((uint8 *)(a))[0] | ((uint8 *)(a))[1] | \
 				  ((uint8 *)(a))[2] | ((uint8 *)(a))[3]) == 0)
@@ -72,53 +72,53 @@
 #define IPV4_ADDR_BCAST(a)	((((uint8 *)(a))[0] & ((uint8 *)(a))[1] & \
 				  ((uint8 *)(a))[2] & ((uint8 *)(a))[3]) == 0xff)
 
-#define	IPV4_TOS_DSCP_MASK	0xfc
-#define	IPV4_TOS_DSCP_SHIFT	2
+#define	IPV4_TOS_DSCP_MASK	0xfc	/* DiffServ codepoint mask */
+#define	IPV4_TOS_DSCP_SHIFT	2	/* DiffServ codepoint shift */
 
 #define	IPV4_TOS(ipv4_body)	(((uint8 *)(ipv4_body))[IPV4_TOS_OFFSET])
 
-#define	IPV4_TOS_PREC_MASK	0xe0
-#define	IPV4_TOS_PREC_SHIFT	5
+#define	IPV4_TOS_PREC_MASK	0xe0	/* Historical precedence mask */
+#define	IPV4_TOS_PREC_SHIFT	5	/* Historical precedence shift */
 
-#define IPV4_TOS_LOWDELAY	0x10
-#define IPV4_TOS_THROUGHPUT	0x8
-#define IPV4_TOS_RELIABILITY	0x4
+#define IPV4_TOS_LOWDELAY	0x10	/* Lowest delay requested */
+#define IPV4_TOS_THROUGHPUT	0x8	/* Best throughput requested */
+#define IPV4_TOS_RELIABILITY	0x4	/* Most reliable delivery requested */
 
 #define IPV4_PROT(ipv4_body)	(((uint8 *)(ipv4_body))[IPV4_PROT_OFFSET])
 
-#define IPV4_FRAG_RESV		0x8000
-#define IPV4_FRAG_DONT		0x4000
-#define IPV4_FRAG_MORE		0x2000
-#define IPV4_FRAG_OFFSET_MASK	0x1fff
-
-#define IPV4_ADDR_STR_LEN	16
+#define IPV4_FRAG_RESV		0x8000	/* Reserved */
+#define IPV4_FRAG_DONT		0x4000	/* Don't fragment */
+#define IPV4_FRAG_MORE		0x2000	/* More fragments */
+#define IPV4_FRAG_OFFSET_MASK	0x1fff	/* Fragment offset */
 
+#define IPV4_ADDR_STR_LEN	16	/* Max IP address length in string format */
 
+/* IPV4 packet formats */
 BWL_PRE_PACKED_STRUCT struct ipv4_addr {
 	uint8	addr[IPV4_ADDR_LEN];
 } BWL_POST_PACKED_STRUCT;
 
 BWL_PRE_PACKED_STRUCT struct ipv4_hdr {
-	uint8	version_ihl;
-	uint8	tos;
-	uint16	tot_len;
+	uint8	version_ihl;		/* Version and Internet Header Length */
+	uint8	tos;			/* Type Of Service */
+	uint16	tot_len;		/* Number of bytes in packet (max 65535) */
 	uint16	id;
-	uint16	frag;
-	uint8	ttl;
-	uint8	prot;
-	uint16	hdr_chksum;
-	uint8	src_ip[IPV4_ADDR_LEN];
-	uint8	dst_ip[IPV4_ADDR_LEN];
+	uint16	frag;			/* 3 flag bits and fragment offset */
+	uint8	ttl;			/* Time To Live */
+	uint8	prot;			/* Protocol */
+	uint16	hdr_chksum;		/* IP header checksum */
+	uint8	src_ip[IPV4_ADDR_LEN];	/* Source IP Address */
+	uint8	dst_ip[IPV4_ADDR_LEN];	/* Destination IP Address */
 } BWL_POST_PACKED_STRUCT;
 
+/* IPV6 field offsets */
+#define IPV6_PAYLOAD_LEN_OFFSET	4	/* payload length offset */
+#define IPV6_NEXT_HDR_OFFSET	6	/* next header/protocol offset */
+#define IPV6_HOP_LIMIT_OFFSET	7	/* hop limit offset */
+#define IPV6_SRC_IP_OFFSET	8	/* src IP addr offset */
+#define IPV6_DEST_IP_OFFSET	24	/* dst IP addr offset */
 
-#define IPV6_PAYLOAD_LEN_OFFSET	4
-#define IPV6_NEXT_HDR_OFFSET	6
-#define IPV6_HOP_LIMIT_OFFSET	7
-#define IPV6_SRC_IP_OFFSET	8
-#define IPV6_DEST_IP_OFFSET	24
-
-
+/* IPV6 field decodes */
 #define IPV6_TRAFFIC_CLASS(ipv6_body) \
 	(((((uint8 *)(ipv6_body))[0] & 0x0f) << 4) | \
 	 ((((uint8 *)(ipv6_body))[1] & 0xf0) >> 4))
@@ -137,14 +137,71 @@ BWL_PRE_PACKED_STRUCT struct ipv4_hdr {
 
 #define IPV6_PROT(ipv6_body)	IPV6_NEXT_HDR(ipv6_body)
 
-#define IPV6_ADDR_LEN		16
-
+#define IPV6_ADDR_LEN		16	/* IPV6 address length */
 
+/* IPV4 TOS or IPV6 Traffic Classifier or 0 */
 #define IP_TOS46(ip_body) \
 	(IP_VER(ip_body) == IP_VER_4 ? IPV4_TOS(ip_body) : \
 	 IP_VER(ip_body) == IP_VER_6 ? IPV6_TRAFFIC_CLASS(ip_body) : 0)
 
+/* IPV6 extension headers (options) */
+#define IPV6_EXTHDR_HOP		0
+#define IPV6_EXTHDR_ROUTING	43
+#define IPV6_EXTHDR_FRAGMENT	44
+#define IPV6_EXTHDR_AUTH	51
+#define IPV6_EXTHDR_NONE	59
+#define IPV6_EXTHDR_DEST	60
+
+#define IPV6_EXTHDR(prot)	(((prot) == IPV6_EXTHDR_HOP) || \
+	                         ((prot) == IPV6_EXTHDR_ROUTING) || \
+	                         ((prot) == IPV6_EXTHDR_FRAGMENT) || \
+	                         ((prot) == IPV6_EXTHDR_AUTH) || \
+	                         ((prot) == IPV6_EXTHDR_NONE) || \
+	                         ((prot) == IPV6_EXTHDR_DEST))
+
+#define IPV6_MIN_HLEN 		40
+
+#define IPV6_EXTHDR_LEN(eh)	((((struct ipv6_exthdr *)(eh))->hdrlen + 1) << 3)
 
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr {
+	uint8	nexthdr;
+	uint8	hdrlen;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr_frag {
+	uint8	nexthdr;
+	uint8	rsvd;
+	uint16	frag_off;
+	uint32	ident;
+} BWL_POST_PACKED_STRUCT;
+
+static INLINE int32
+ipv6_exthdr_len(uint8 *h, uint8 *proto)
+{
+	uint16 len = 0, hlen;
+	struct ipv6_exthdr *eh = (struct ipv6_exthdr *)h;
+
+	while (IPV6_EXTHDR(eh->nexthdr)) {
+		if (eh->nexthdr == IPV6_EXTHDR_NONE)
+			return -1;
+		else if (eh->nexthdr == IPV6_EXTHDR_FRAGMENT)
+			hlen = 8;
+		else if (eh->nexthdr == IPV6_EXTHDR_AUTH)
+			hlen = (eh->hdrlen + 2) << 2;
+		else
+			hlen = IPV6_EXTHDR_LEN(eh);
+
+		len += hlen;
+		eh = (struct ipv6_exthdr *)(h + len);
+	}
+
+	*proto = eh->nexthdr;
+	return len;
+}
+
+#define IPV4_ISMULTI(a) (((a) & 0xf0000000) == 0xe0000000)
+
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
-#endif
+#endif	/* _bcmip_h_ */
diff --git a/bcmdhd/dhdutil/include/proto/bt_amp_hci.h b/bcmdhd/dhdutil/include/proto/bt_amp_hci.h
index 2ef2dd8..6d4de22 100644
--- a/bcmdhd/dhdutil/include/proto/bt_amp_hci.h
+++ b/bcmdhd/dhdutil/include/proto/bt_amp_hci.h
@@ -1,8 +1,8 @@
 /*
  * BT-AMP (BlueTooth Alternate Mac and Phy) HCI (Host/Controller Interface)
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bt_amp_hci.h,v 9.14.8.2 2010-09-10 18:37:47 Exp $
+ * $Id: bt_amp_hci.h 382882 2013-02-04 23:24:31Z $
 */
 
 #ifndef _bt_amp_hci_h
@@ -205,7 +205,6 @@ typedef BWL_PRE_PACKED_STRUCT struct amp_hci_event {
 #define HCI_Short_Range_Mode_Change_Complete_Event_Mask		0x1000
 #define HCI_Status_Change_Event_Mask				0x2000
 #define HCI_All_Event_Mask					0x31e7
-
 /* AMP HCI event parameters */
 typedef BWL_PRE_PACKED_STRUCT struct cmd_status_parms {
 	uint8 status;
diff --git a/bcmdhd/dhdutil/include/proto/eapol.h b/bcmdhd/dhdutil/include/proto/eapol.h
new file mode 100644
index 0000000..df27049
--- /dev/null
+++ b/bcmdhd/dhdutil/include/proto/eapol.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: eapol.h 382882 2013-02-04 23:24:31Z $
+ */
+
+#ifndef _eapol_h_
+#define _eapol_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#include <bcmcrypto/aeskeywrap.h>
+
+/* EAPOL for 802.3/Ethernet */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	struct ether_header eth;	/* 802.3/Ethernet header */
+	unsigned char version;		/* EAPOL protocol version */
+	unsigned char type;		/* EAPOL type */
+	unsigned short length;		/* Length of body */
+	unsigned char body[1];		/* Body (optional) */
+} BWL_POST_PACKED_STRUCT eapol_header_t;
+
+#define EAPOL_HEADER_LEN 18
+
+typedef struct {
+	unsigned char version;		/* EAPOL protocol version */
+	unsigned char type;		/* EAPOL type */
+	unsigned short length;		/* Length of body */
+} eapol_hdr_t;
+
+#define EAPOL_HDR_LEN 4
+
+/* EAPOL version */
+#define WPA2_EAPOL_VERSION	2
+#define WPA_EAPOL_VERSION	1
+#define LEAP_EAPOL_VERSION	1
+#define SES_EAPOL_VERSION	1
+
+/* EAPOL types */
+#define EAP_PACKET		0
+#define EAPOL_START		1
+#define EAPOL_LOGOFF		2
+#define EAPOL_KEY		3
+#define EAPOL_ASF		4
+
+/* EAPOL-Key types */
+#define EAPOL_RC4_KEY		1
+#define EAPOL_WPA2_KEY		2	/* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY		254	/* WPA */
+
+/* RC4 EAPOL-Key header field sizes */
+#define EAPOL_KEY_REPLAY_LEN	8
+#define EAPOL_KEY_IV_LEN	16
+#define EAPOL_KEY_SIG_LEN	16
+
+/* RC4 EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	unsigned char type;			/* Key Descriptor Type */
+	unsigned short length;			/* Key Length (unaligned) */
+	unsigned char replay[EAPOL_KEY_REPLAY_LEN];	/* Replay Counter */
+	unsigned char iv[EAPOL_KEY_IV_LEN];		/* Key IV */
+	unsigned char index;				/* Key Flags & Index */
+	unsigned char signature[EAPOL_KEY_SIG_LEN];	/* Key Signature */
+	unsigned char key[1];				/* Key (optional) */
+} BWL_POST_PACKED_STRUCT eapol_key_header_t;
+
+#define EAPOL_KEY_HEADER_LEN 	44
+
+/* RC4 EAPOL-Key flags */
+#define EAPOL_KEY_FLAGS_MASK	0x80
+#define EAPOL_KEY_BROADCAST	0
+#define EAPOL_KEY_UNICAST	0x80
+
+/* RC4 EAPOL-Key index */
+#define EAPOL_KEY_INDEX_MASK	0x7f
+
+/* WPA/802.11i/WPA2 EAPOL-Key header field sizes */
+#define EAPOL_WPA_KEY_REPLAY_LEN	8
+#define EAPOL_WPA_KEY_NONCE_LEN		32
+#define EAPOL_WPA_KEY_IV_LEN		16
+#define EAPOL_WPA_KEY_RSC_LEN		8
+#define EAPOL_WPA_KEY_ID_LEN		8
+#define EAPOL_WPA_KEY_MIC_LEN		16
+#define EAPOL_WPA_KEY_DATA_LEN		(EAPOL_WPA_MAX_KEY_SIZE + AKW_BLOCK_LEN)
+#define EAPOL_WPA_MAX_KEY_SIZE		32
+
+/* WPA EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	unsigned char type;		/* Key Descriptor Type */
+	unsigned short key_info;	/* Key Information (unaligned) */
+	unsigned short key_len;		/* Key Length (unaligned) */
+	unsigned char replay[EAPOL_WPA_KEY_REPLAY_LEN];	/* Replay Counter */
+	unsigned char nonce[EAPOL_WPA_KEY_NONCE_LEN];	/* Nonce */
+	unsigned char iv[EAPOL_WPA_KEY_IV_LEN];		/* Key IV */
+	unsigned char rsc[EAPOL_WPA_KEY_RSC_LEN];	/* Key RSC */
+	unsigned char id[EAPOL_WPA_KEY_ID_LEN];		/* WPA:Key ID, 802.11i/WPA2: Reserved */
+	unsigned char mic[EAPOL_WPA_KEY_MIC_LEN];	/* Key MIC */
+	unsigned short data_len;			/* Key Data Length */
+	unsigned char data[EAPOL_WPA_KEY_DATA_LEN];	/* Key data */
+} BWL_POST_PACKED_STRUCT eapol_wpa_key_header_t;
+
+#define EAPOL_WPA_KEY_LEN 		95
+
+/* WPA/802.11i/WPA2 KEY KEY_INFO bits */
+#define WPA_KEY_DESC_V1		0x01
+#define WPA_KEY_DESC_V2		0x02
+#define WPA_KEY_DESC_V3		0x03
+#define WPA_KEY_PAIRWISE	0x08
+#define WPA_KEY_INSTALL		0x40
+#define WPA_KEY_ACK		0x80
+#define WPA_KEY_MIC		0x100
+#define WPA_KEY_SECURE		0x200
+#define WPA_KEY_ERROR		0x400
+#define WPA_KEY_REQ		0x800
+
+#define WPA_KEY_DESC_V2_OR_V3 WPA_KEY_DESC_V2
+
+/* WPA-only KEY KEY_INFO bits */
+#define WPA_KEY_INDEX_0		0x00
+#define WPA_KEY_INDEX_1		0x10
+#define WPA_KEY_INDEX_2		0x20
+#define WPA_KEY_INDEX_3		0x30
+#define WPA_KEY_INDEX_MASK	0x30
+#define WPA_KEY_INDEX_SHIFT	0x04
+
+/* 802.11i/WPA2-only KEY KEY_INFO bits */
+#define WPA_KEY_ENCRYPTED_DATA	0x1000
+
+/* Key Data encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8 type;
+	uint8 length;
+	uint8 oui[3];
+	uint8 subtype;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_encap_data_t;
+
+#define EAPOL_WPA2_ENCAP_DATA_HDR_LEN 	6
+
+#define WPA2_KEY_DATA_SUBTYPE_GTK	1
+#define WPA2_KEY_DATA_SUBTYPE_STAKEY	2
+#define WPA2_KEY_DATA_SUBTYPE_MAC	3
+#define WPA2_KEY_DATA_SUBTYPE_PMKID	4
+#define WPA2_KEY_DATA_SUBTYPE_IGTK	9
+
+/* GTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8	flags;
+	uint8	reserved;
+	uint8	gtk[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_gtk_encap_t;
+
+#define EAPOL_WPA2_KEY_GTK_ENCAP_HDR_LEN 	2
+
+#define WPA2_GTK_INDEX_MASK	0x03
+#define WPA2_GTK_INDEX_SHIFT	0x00
+
+#define WPA2_GTK_TRANSMIT	0x04
+
+/* IGTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16	key_id;
+	uint8	ipn[6];
+	uint8	key[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_igtk_encap_t;
+
+#define EAPOL_WPA2_KEY_IGTK_ENCAP_HDR_LEN 	8
+
+/* STAKey encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8	reserved[2];
+	uint8	mac[ETHER_ADDR_LEN];
+	uint8	stakey[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_stakey_encap_t;
+
+#define WPA2_KEY_DATA_PAD	0xdd
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _eapol_h_ */
diff --git a/bcmdhd/dhdutil/include/proto/ethernet.h b/bcmdhd/dhdutil/include/proto/ethernet.h
index 8480bca..46c2b95 100644
--- a/bcmdhd/dhdutil/include/proto/ethernet.h
+++ b/bcmdhd/dhdutil/include/proto/ethernet.h
@@ -1,8 +1,8 @@
 /*
  * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,68 +15,90 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: ethernet.h 309193 2012-01-19 00:03:57Z $
+ * $Id: ethernet.h 384540 2013-02-12 04:28:58Z $
  */
 
-
-#ifndef _NET_ETHERNET_H_
+#ifndef _NET_ETHERNET_H_	    /* use native BSD ethernet.h when available */
 #define _NET_ETHERNET_H_
 
 #ifndef _TYPEDEFS_H_
 #include "typedefs.h"
 #endif
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
 
-
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
 #define	ETHER_ADDR_LEN		6
 
-
+/*
+ * The number of bytes in the type field.
+ */
 #define	ETHER_TYPE_LEN		2
 
-
+/*
+ * The number of bytes in the trailing CRC field.
+ */
 #define	ETHER_CRC_LEN		4
 
-
+/*
+ * The length of the combined header.
+ */
 #define	ETHER_HDR_LEN		(ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
 
-
+/*
+ * The minimum packet length.
+ */
 #define	ETHER_MIN_LEN		64
 
-
+/*
+ * The minimum packet user data length.
+ */
 #define	ETHER_MIN_DATA		46
 
-
+/*
+ * The maximum packet length.
+ */
 #define	ETHER_MAX_LEN		1518
 
-
+/*
+ * The maximum packet user data length.
+ */
 #define	ETHER_MAX_DATA		1500
 
+/* ether types */
+#define ETHER_TYPE_MIN		0x0600		/* Anything less than MIN is a length */
+#define	ETHER_TYPE_IP		0x0800		/* IP */
+#define ETHER_TYPE_ARP		0x0806		/* ARP */
+#define ETHER_TYPE_8021Q	0x8100		/* 802.1Q */
+#define	ETHER_TYPE_IPV6		0x86dd		/* IPv6 */
+#define	ETHER_TYPE_BRCM		0x886c		/* Broadcom Corp. */
+#define	ETHER_TYPE_802_1X	0x888e		/* 802.1x */
+#ifdef PLC
+#define	ETHER_TYPE_88E1		0x88e1		/* GIGLE */
+#define	ETHER_TYPE_8912		0x8912		/* GIGLE */
+#define ETHER_TYPE_GIGLED	0xffff		/* GIGLE */
+#endif /* PLC */
+#define	ETHER_TYPE_802_1X_PREAUTH 0x88c7	/* 802.1x preauthentication */
+#define ETHER_TYPE_WAI		0x88b4		/* WAI */
+#define ETHER_TYPE_89_0D	0x890d		/* 89-0d frame for TDLS */
+
+#define ETHER_TYPE_PPP_SES	0x8864		/* PPPoE Session */
+
+/* Broadcom subtype follows ethertype;  First 2 bytes are reserved; Next 2 are subtype; */
+#define	ETHER_BRCM_SUBTYPE_LEN	4	/* Broadcom 4 byte subtype */
+
+/* ether header */
+#define ETHER_DEST_OFFSET	(0 * ETHER_ADDR_LEN)	/* dest address offset */
+#define ETHER_SRC_OFFSET	(1 * ETHER_ADDR_LEN)	/* src address offset */
+#define ETHER_TYPE_OFFSET	(2 * ETHER_ADDR_LEN)	/* ether type offset */
 
-#define ETHER_TYPE_MIN		0x0600
-#define	ETHER_TYPE_IP		0x0800
-#define ETHER_TYPE_ARP		0x0806
-#define ETHER_TYPE_8021Q	0x8100
-#define	ETHER_TYPE_IPV6		0x86dd		
-#define	ETHER_TYPE_BRCM		0x886c		
-#define	ETHER_TYPE_802_1X	0x888e		
-#define	ETHER_TYPE_802_1X_PREAUTH 0x88c7	
-#define ETHER_TYPE_WAI		0x88b4		
-#define ETHER_TYPE_89_0D	0x890d		
-
-#define ETHER_TYPE_IPV6		0x86dd		
-
-
-#define	ETHER_BRCM_SUBTYPE_LEN	4	
-
-
-#define ETHER_DEST_OFFSET	(0 * ETHER_ADDR_LEN)
-#define ETHER_SRC_OFFSET	(1 * ETHER_ADDR_LEN)
-#define ETHER_TYPE_OFFSET	(2 * ETHER_ADDR_LEN)
-
-
+/*
+ * A macro to validate a length with
+ */
 #define	ETHER_IS_VALID_LEN(foo)	\
 	((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
 
@@ -89,61 +111,91 @@
 		((uint8 *)ea)[5] = ((mgrp_ip) >>  0) & 0xff;	\
 }
 
-#ifndef __INCif_etherh
-
+#ifndef __INCif_etherh     /* Quick and ugly hack for VxWorks */
+/*
+ * Structure of a 10Mb/s Ethernet header.
+ */
 BWL_PRE_PACKED_STRUCT struct ether_header {
 	uint8	ether_dhost[ETHER_ADDR_LEN];
 	uint8	ether_shost[ETHER_ADDR_LEN];
 	uint16	ether_type;
 } BWL_POST_PACKED_STRUCT;
 
-
+/*
+ * Structure of a 48-bit Ethernet address.
+ */
 BWL_PRE_PACKED_STRUCT struct	ether_addr {
 	uint8 octet[ETHER_ADDR_LEN];
 } BWL_POST_PACKED_STRUCT;
-#endif
-
+#endif	/* !__INCif_etherh Quick and ugly hack for VxWorks */
 
+/*
+ * Takes a pointer, set, test, clear, toggle locally admininistered
+ * address bit in the 48-bit Ethernet address.
+ */
 #define ETHER_SET_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] | 2))
 #define ETHER_IS_LOCALADDR(ea) 	(((uint8 *)(ea))[0] & 2)
 #define ETHER_CLR_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xfd))
 #define ETHER_TOGGLE_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] ^ 2))
 
-
+/* Takes a pointer, marks unicast address bit in the MAC address */
 #define ETHER_SET_UNICAST(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & ~1))
 
-
+/*
+ * Takes a pointer, returns true if a 48-bit multicast address
+ * (including broadcast, since it is all ones)
+ */
 #define ETHER_ISMULTI(ea) (((const uint8 *)(ea))[0] & 1)
 
 
+/* compare two ethernet addresses - assumes the pointers can be referenced as shorts */
+#define eacmp(a, b)	((((const uint16 *)(a))[0] ^ ((const uint16 *)(b))[0]) | \
+	                 (((const uint16 *)(a))[1] ^ ((const uint16 *)(b))[1]) | \
+	                 (((const uint16 *)(a))[2] ^ ((const uint16 *)(b))[2]))
+
+#define	ether_cmp(a, b)	eacmp(a, b)
+
+/* copy an ethernet address - assumes the pointers can be referenced as shorts */
+#define eacopy(s, d) \
+do { \
+	((uint16 *)(d))[0] = ((const uint16 *)(s))[0]; \
+	((uint16 *)(d))[1] = ((const uint16 *)(s))[1]; \
+	((uint16 *)(d))[2] = ((const uint16 *)(s))[2]; \
+} while (0)
 
-#define	ether_cmp(a, b)	(!(((short*)(a))[0] == ((short*)(b))[0]) | \
-			 !(((short*)(a))[1] == ((short*)(b))[1]) | \
-			 !(((short*)(a))[2] == ((short*)(b))[2]))
+#define	ether_copy(s, d) eacopy(s, d)
 
+/* Copy an ethernet address in reverse order */
+#define	ether_rcopy(s, d) \
+do { \
+	((uint16 *)(d))[2] = ((uint16 *)(s))[2]; \
+	((uint16 *)(d))[1] = ((uint16 *)(s))[1]; \
+	((uint16 *)(d))[0] = ((uint16 *)(s))[0]; \
+} while (0)
 
-#define	ether_copy(s, d) { \
-		((short*)(d))[0] = ((const short*)(s))[0]; \
-		((short*)(d))[1] = ((const short*)(s))[1]; \
-		((short*)(d))[2] = ((const short*)(s))[2]; }
 
 
 static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
 static const struct ether_addr ether_null = {{0, 0, 0, 0, 0, 0}};
-
-#define ETHER_ISBCAST(ea)	((((uint8 *)(ea))[0] &		\
-	                          ((uint8 *)(ea))[1] &		\
-				  ((uint8 *)(ea))[2] &		\
-				  ((uint8 *)(ea))[3] &		\
-				  ((uint8 *)(ea))[4] &		\
-				  ((uint8 *)(ea))[5]) == 0xff)
-#define ETHER_ISNULLADDR(ea)	((((uint8 *)(ea))[0] |		\
-				  ((uint8 *)(ea))[1] |		\
-				  ((uint8 *)(ea))[2] |		\
-				  ((uint8 *)(ea))[3] |		\
-				  ((uint8 *)(ea))[4] |		\
-				  ((uint8 *)(ea))[5]) == 0)
-
+static const struct ether_addr ether_ipv6_mcast = {{0x33, 0x33, 0x00, 0x00, 0x00, 0x01}};
+
+#define ETHER_ISBCAST(ea)	((((const uint8 *)(ea))[0] &		\
+	                          ((const uint8 *)(ea))[1] &		\
+				  ((const uint8 *)(ea))[2] &		\
+				  ((const uint8 *)(ea))[3] &		\
+				  ((const uint8 *)(ea))[4] &		\
+				  ((const uint8 *)(ea))[5]) == 0xff)
+#define ETHER_ISNULLADDR(ea)	((((const uint8 *)(ea))[0] |		\
+				  ((const uint8 *)(ea))[1] |		\
+				  ((const uint8 *)(ea))[2] |		\
+				  ((const uint8 *)(ea))[3] |		\
+				  ((const uint8 *)(ea))[4] |		\
+				  ((const uint8 *)(ea))[5]) == 0)
+
+#define ETHER_ISNULLDEST(da)	((((const uint16 *)(da))[0] |           \
+				  ((const uint16 *)(da))[1] |           \
+				  ((const uint16 *)(da))[2]) == 0)
+#define ETHER_ISNULLSRC(sa)	ETHER_ISNULLDEST(sa)
 
 #define ETHER_MOVE_HDR(d, s) \
 do { \
@@ -152,7 +204,9 @@ do { \
 	*(struct ether_header *)(d) = t; \
 } while (0)
 
+#define  ETHER_ISUCAST(ea) ((((uint8 *)(ea))[0] & 0x01) == 0)
 
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
-#endif
+#endif /* _NET_ETHERNET_H_ */
diff --git a/bcmdhd/dhdutil/include/proto/p2p.h b/bcmdhd/dhdutil/include/proto/p2p.h
new file mode 100644
index 0000000..48b52e1
--- /dev/null
+++ b/bcmdhd/dhdutil/include/proto/p2p.h
@@ -0,0 +1,575 @@
+/*
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Fundamental types and constants relating to WFA P2P (aka WiFi Direct)
+ *
+ * $Id: p2p.h 384536 2013-02-12 04:13:09Z $
+ */
+
+#ifndef _P2P_H_
+#define _P2P_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <wlioctl.h>
+#include <proto/802.11.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WiFi P2P OUI values */
+#define P2P_OUI			WFA_OUI			/* WiFi P2P OUI */
+#define P2P_VER			WFA_OUI_TYPE_P2P	/* P2P version: 9=WiFi P2P v1.0 */
+
+#define P2P_IE_ID		0xdd			/* P2P IE element ID */
+
+/* WiFi P2P IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ie {
+	uint8	id;		/* IE ID: 0xDD */
+	uint8	len;		/* IE length */
+	uint8	OUI[3];		/* WiFi P2P specific OUI: P2P_OUI */
+	uint8	oui_type;	/* Identifies P2P version: P2P_VER */
+	uint8	subelts[1];	/* variable length subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ie wifi_p2p_ie_t;
+
+#define P2P_IE_FIXED_LEN	6
+
+#define P2P_ATTR_ID_OFF		0
+#define P2P_ATTR_LEN_OFF	1
+#define P2P_ATTR_DATA_OFF	3
+
+#define P2P_ATTR_ID_LEN		1	/* ID filed length */
+#define P2P_ATTR_LEN_LEN	2	/* length field length */
+#define P2P_ATTR_HDR_LEN	3 /* ID + 2-byte length field spec 1.02 */
+
+/* P2P IE Subelement IDs from WiFi P2P Technical Spec 1.00 */
+#define P2P_SEID_STATUS			0	/* Status */
+#define P2P_SEID_MINOR_RC		1	/* Minor Reason Code */
+#define P2P_SEID_P2P_INFO		2	/* P2P Capability (capabilities info) */
+#define P2P_SEID_DEV_ID			3	/* P2P Device ID */
+#define P2P_SEID_INTENT			4	/* Group Owner Intent */
+#define P2P_SEID_CFG_TIMEOUT		5	/* Configuration Timeout */
+#define P2P_SEID_CHANNEL		6	/* Listen channel */
+#define P2P_SEID_GRP_BSSID		7	/* P2P Group BSSID */
+#define P2P_SEID_XT_TIMING		8	/* Extended Listen Timing */
+#define P2P_SEID_INTINTADDR		9	/* Intended P2P Interface Address */
+#define P2P_SEID_P2P_MGBTY		10	/* P2P Manageability */
+#define P2P_SEID_CHAN_LIST		11	/* Channel List */
+#define P2P_SEID_ABSENCE		12	/* Notice of Absence */
+#define P2P_SEID_DEV_INFO		13	/* Device Info */
+#define P2P_SEID_GROUP_INFO		14	/* Group Info */
+#define P2P_SEID_GROUP_ID		15	/* Group ID */
+#define P2P_SEID_P2P_IF			16	/* P2P Interface */
+#define P2P_SEID_OP_CHANNEL		17	/* Operating Channel */
+#define P2P_SEID_INVITE_FLAGS		18	/* Invitation Flags */
+#define P2P_SEID_VNDR			221	/* Vendor-specific subelement */
+
+#define P2P_SE_VS_ID_SERVICES	0x1b /* BRCM proprietary subel: L2 Services */
+
+
+/* WiFi P2P IE subelement: P2P Capability (capabilities info) */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_info_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_P2P_INFO */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	dev;		/* Device Capability Bitmap */
+	uint8	group;		/* Group Capability Bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_info_se_s wifi_p2p_info_se_t;
+
+/* P2P Capability subelement's Device Capability Bitmap bit values */
+#define P2P_CAPSE_DEV_SERVICE_DIS	0x1 /* Service Discovery */
+#define P2P_CAPSE_DEV_CLIENT_DIS	0x2 /* Client Discoverability */
+#define P2P_CAPSE_DEV_CONCURRENT	0x4 /* Concurrent Operation */
+#define P2P_CAPSE_DEV_INFRA_MAN		0x8 /* P2P Infrastructure Managed */
+#define P2P_CAPSE_DEV_LIMIT			0x10 /* P2P Device Limit */
+#define P2P_CAPSE_INVITE_PROC		0x20 /* P2P Invitation Procedure */
+
+/* P2P Capability subelement's Group Capability Bitmap bit values */
+#define P2P_CAPSE_GRP_OWNER			0x1 /* P2P Group Owner */
+#define P2P_CAPSE_PERSIST_GRP		0x2 /* Persistent P2P Group */
+#define P2P_CAPSE_GRP_LIMIT			0x4 /* P2P Group Limit */
+#define P2P_CAPSE_GRP_INTRA_BSS		0x8 /* Intra-BSS Distribution */
+#define P2P_CAPSE_GRP_X_CONNECT		0x10 /* Cross Connection */
+#define P2P_CAPSE_GRP_PERSISTENT	0x20 /* Persistent Reconnect */
+#define P2P_CAPSE_GRP_FORMATION		0x40 /* Group Formation */
+
+
+/* WiFi P2P IE subelement: Group Owner Intent */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intent_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_INTENT */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	intent;		/* Intent Value 0...15 (0=legacy 15=master only) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intent_se_s wifi_p2p_intent_se_t;
+
+/* WiFi P2P IE subelement: Configuration Timeout */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cfg_tmo_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_CFG_TIMEOUT */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	go_tmo;		/* GO config timeout in units of 10 ms */
+	uint8	client_tmo;	/* Client config timeout in units of 10 ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cfg_tmo_se_s wifi_p2p_cfg_tmo_se_t;
+
+/* WiFi P2P IE subelement: Listen Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_listen_channel_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_CHANNEL */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	country[3];	/* Country String */
+	uint8	op_class;	/* Operating Class */
+	uint8	channel;	/* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_listen_channel_se_s wifi_p2p_listen_channel_se_t;
+
+/* WiFi P2P IE subelement: P2P Group BSSID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_bssid_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_GRP_BSSID */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* P2P group bssid */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_bssid_se_s wifi_p2p_grp_bssid_se_t;
+
+/* WiFi P2P IE subelement: P2P Group ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_id_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_GROUP_ID */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* P2P device address */
+	uint8	ssid[1];	/* ssid. device id. variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_id_se_s wifi_p2p_grp_id_se_t;
+
+/* WiFi P2P IE subelement: P2P Interface */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intf_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_P2P_IF */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* P2P device address */
+	uint8	ifaddrs;	/* P2P Interface Address count */
+	uint8	ifaddr[1][6];	/* P2P Interface Address list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intf_se_s wifi_p2p_intf_se_t;
+
+/* WiFi P2P IE subelement: Status */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_status_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_STATUS */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	status;		/* Status Code: P2P_STATSE_* */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_status_se_s wifi_p2p_status_se_t;
+
+/* Status subelement Status Code definitions */
+#define P2P_STATSE_SUCCESS			0
+				/* Success */
+#define P2P_STATSE_FAIL_INFO_CURR_UNAVAIL	1
+				/* Failed, information currently unavailable */
+#define P2P_STATSE_PASSED_UP			P2P_STATSE_FAIL_INFO_CURR_UNAVAIL
+				/* Old name for above in P2P spec 1.08 and older */
+#define P2P_STATSE_FAIL_INCOMPAT_PARAMS		2
+				/* Failed, incompatible parameters */
+#define P2P_STATSE_FAIL_LIMIT_REACHED		3
+				/* Failed, limit reached */
+#define P2P_STATSE_FAIL_INVALID_PARAMS		4
+				/* Failed, invalid parameters */
+#define P2P_STATSE_FAIL_UNABLE_TO_ACCOM		5
+				/* Failed, unable to accomodate request */
+#define P2P_STATSE_FAIL_PROTO_ERROR		6
+				/* Failed, previous protocol error or disruptive behaviour */
+#define P2P_STATSE_FAIL_NO_COMMON_CHAN		7
+				/* Failed, no common channels */
+#define P2P_STATSE_FAIL_UNKNOWN_GROUP		8
+				/* Failed, unknown P2P Group */
+#define P2P_STATSE_FAIL_INTENT			9
+				/* Failed, both peers indicated Intent 15 in GO Negotiation */
+#define P2P_STATSE_FAIL_INCOMPAT_PROVIS		10
+				/* Failed, incompatible provisioning method */
+#define P2P_STATSE_FAIL_USER_REJECT		11
+				/* Failed, rejected by user */
+
+/* WiFi P2P IE attribute: Extended Listen Timing */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ext_se_s {
+	uint8	eltId;		/* ID: P2P_SEID_EXT_TIMING */
+	uint8	len[2];		/* length not including eltId, len fields */
+	uint8	avail[2];	/* availibility period */
+	uint8	interval[2];	/* availibility interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ext_se_s wifi_p2p_ext_se_t;
+
+#define P2P_EXT_MIN	10	/* minimum 10ms */
+
+/* WiFi P2P IE subelement: Intended P2P Interface Address */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intintad_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_INTINTADDR */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* intended P2P interface MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intintad_se_s wifi_p2p_intintad_se_t;
+
+/* WiFi P2P IE subelement: Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_channel_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_STATUS */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	band;		/* Regulatory Class (band) */
+	uint8	channel;	/* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_channel_se_s wifi_p2p_channel_se_t;
+
+
+/* Channel Entry structure within the Channel List SE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_entry_s {
+	uint8	band;						/* Regulatory Class (band) */
+	uint8	num_channels;				/* # of channels in the channel list */
+	uint8	channels[WL_NUMCHANNELS];	/* Channel List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_entry_s wifi_p2p_chanlist_entry_t;
+#define WIFI_P2P_CHANLIST_SE_MAX_ENTRIES 2
+
+/* WiFi P2P IE subelement: Channel List */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_CHAN_LIST */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	country[3];	/* Country String */
+	uint8	num_entries;	/* # of channel entries */
+	wifi_p2p_chanlist_entry_t	entries[WIFI_P2P_CHANLIST_SE_MAX_ENTRIES];
+						/* Channel Entry List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_se_s wifi_p2p_chanlist_se_t;
+
+/* WiFi Primary Device Type structure */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pri_devtype_s {
+	uint16	cat_id;		/* Category ID */
+	uint8	OUI[3];		/* WFA OUI: 0x0050F2 */
+	uint8	oui_type;	/* WPS_OUI_TYPE */
+	uint16	sub_cat_id;	/* Sub Category ID */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pri_devtype_s wifi_p2p_pri_devtype_t;
+
+/* WiFi P2P IE's Device Info subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devinfo_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_DEVINFO */
+	uint8	len[2];			/* SE length not including eltId, len fields */
+	uint8	mac[6];			/* P2P Device MAC address */
+	uint16	wps_cfg_meths;		/* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+	uint8	pri_devtype[8];		/* Primary Device Type */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devinfo_se_s wifi_p2p_devinfo_se_t;
+
+#define P2P_DEV_TYPE_LEN	8
+
+/* WiFi P2P IE's Group Info subelement Client Info Descriptor */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cid_fixed_s {
+	uint8	len;
+	uint8	devaddr[ETHER_ADDR_LEN];	/* P2P Device Address */
+	uint8	ifaddr[ETHER_ADDR_LEN];		/* P2P Interface Address */
+	uint8	devcap;				/* Device Capability */
+	uint8	cfg_meths[2];			/* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+	uint8	pridt[P2P_DEV_TYPE_LEN];	/* Primary Device Type */
+	uint8	secdts;				/* Number of Secondary Device Types */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cid_fixed_s wifi_p2p_cid_fixed_t;
+
+/* WiFi P2P IE's Device ID subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devid_se_s {
+	uint8	eltId;
+	uint8	len[2];
+	struct ether_addr	addr;			/* P2P Device MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devid_se_s wifi_p2p_devid_se_t;
+
+/* WiFi P2P IE subelement: P2P Manageability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_mgbt_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_P2P_MGBTY */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mg_bitmap;	/* manageability bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_mgbt_se_s wifi_p2p_mgbt_se_t;
+/* mg_bitmap field bit values */
+#define P2P_MGBTSE_P2PDEVMGMT_FLAG   0x1 /* AP supports Managed P2P Device */
+
+/* WiFi P2P IE subelement: Group Info */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grpinfo_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_GROUP_INFO */
+	uint8	len[2];			/* SE length not including eltId, len fields */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grpinfo_se_s wifi_p2p_grpinfo_se_t;
+
+/* WiFi IE subelement: Operating Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_op_channel_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_OP_CHANNEL */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	country[3];	/* Country String */
+	uint8	op_class;	/* Operating Class */
+	uint8	channel;	/* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_op_channel_se_s wifi_p2p_op_channel_se_t;
+
+/* WiFi IE subelement: INVITATION FLAGS */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_invite_flags_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_INVITE_FLAGS */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	flags;		/* Flags */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_invite_flags_se_s wifi_p2p_invite_flags_se_t;
+
+/* WiFi P2P Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_action_frame {
+	uint8	category;	/* P2P_AF_CATEGORY */
+	uint8	OUI[3];		/* OUI - P2P_OUI */
+	uint8	type;		/* OUI Type - P2P_VER */
+	uint8	subtype;	/* OUI Subtype - P2P_AF_* */
+	uint8	dialog_token;	/* nonzero, identifies req/resp tranaction */
+	uint8	elts[1];	/* Variable length information elements.  Max size =
+				 * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+				 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_action_frame wifi_p2p_action_frame_t;
+#define P2P_AF_CATEGORY		0x7f
+
+#define P2P_AF_FIXED_LEN	7
+
+/* WiFi P2P Action Frame OUI Subtypes */
+#define P2P_AF_NOTICE_OF_ABSENCE	0	/* Notice of Absence */
+#define P2P_AF_PRESENCE_REQ		1	/* P2P Presence Request */
+#define P2P_AF_PRESENCE_RSP		2	/* P2P Presence Response */
+#define P2P_AF_GO_DISC_REQ		3	/* GO Discoverability Request */
+
+
+/* WiFi P2P Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pub_act_frame {
+	uint8	category;	/* P2P_PUB_AF_CATEGORY */
+	uint8	action;		/* P2P_PUB_AF_ACTION */
+	uint8	oui[3];		/* P2P_OUI */
+	uint8	oui_type;	/* OUI type - P2P_VER */
+	uint8	subtype;	/* OUI subtype - P2P_TYPE_* */
+	uint8	dialog_token;	/* nonzero, identifies req/rsp transaction */
+	uint8	elts[1];	/* Variable length information elements.  Max size =
+				 * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+				 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pub_act_frame wifi_p2p_pub_act_frame_t;
+#define P2P_PUB_AF_FIXED_LEN	8
+#define P2P_PUB_AF_CATEGORY	0x04
+#define P2P_PUB_AF_ACTION	0x09
+
+/* WiFi P2P Public Action Frame OUI Subtypes */
+#define P2P_PAF_GON_REQ		0	/* Group Owner Negotiation Req */
+#define P2P_PAF_GON_RSP		1	/* Group Owner Negotiation Rsp */
+#define P2P_PAF_GON_CONF	2	/* Group Owner Negotiation Confirm */
+#define P2P_PAF_INVITE_REQ	3	/* P2P Invitation Request */
+#define P2P_PAF_INVITE_RSP	4	/* P2P Invitation Response */
+#define P2P_PAF_DEVDIS_REQ	5	/* Device Discoverability Request */
+#define P2P_PAF_DEVDIS_RSP	6	/* Device Discoverability Response */
+#define P2P_PAF_PROVDIS_REQ	7	/* Provision Discovery Request */
+#define P2P_PAF_PROVDIS_RSP	8	/* Provision Discovery Response */
+#define P2P_PAF_SUBTYPE_INVALID	255	/* Invalid Subtype */
+
+/* TODO: Stop using these obsolete aliases for P2P_PAF_GON_* */
+#define P2P_TYPE_MNREQ		P2P_PAF_GON_REQ
+#define P2P_TYPE_MNRSP		P2P_PAF_GON_RSP
+#define P2P_TYPE_MNCONF		P2P_PAF_GON_CONF
+
+/* WiFi P2P IE subelement: Notice of Absence */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_desc {
+	uint8	cnt_type;	/* Count/Type */
+	uint32	duration;	/* Duration */
+	uint32	interval;	/* Interval */
+	uint32	start;		/* Start Time */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_desc wifi_p2p_noa_desc_t;
+
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_se {
+	uint8	eltId;		/* Subelement ID */
+	uint8	len[2];		/* Length */
+	uint8	index;		/* Index */
+	uint8	ops_ctw_parms;	/* CTWindow and OppPS Parameters */
+	wifi_p2p_noa_desc_t	desc[1];	/* Notice of Absence Descriptor(s) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_se wifi_p2p_noa_se_t;
+
+#define P2P_NOA_SE_FIXED_LEN	5
+
+#define P2P_NOA_SE_MAX_DESC	2	/* max NoA descriptors in presence request */
+
+/* cnt_type field values */
+#define P2P_NOA_DESC_CNT_RESERVED	0	/* reserved and should not be used */
+#define P2P_NOA_DESC_CNT_REPEAT		255	/* continuous schedule */
+#define P2P_NOA_DESC_TYPE_PREFERRED	1	/* preferred values */
+#define P2P_NOA_DESC_TYPE_ACCEPTABLE	2	/* acceptable limits */
+
+/* ctw_ops_parms field values */
+#define P2P_NOA_CTW_MASK	0x7f
+#define P2P_NOA_OPS_MASK	0x80
+#define P2P_NOA_OPS_SHIFT	7
+
+#define P2P_CTW_MIN	10	/* minimum 10TU */
+
+/*
+ * P2P Service Discovery related
+ */
+#define	P2PSD_ACTION_CATEGORY		0x04
+				/* Public action frame */
+#define	P2PSD_ACTION_ID_GAS_IREQ	0x0a
+				/* Action value for GAS Initial Request AF */
+#define	P2PSD_ACTION_ID_GAS_IRESP	0x0b
+				/* Action value for GAS Initial Response AF */
+#define	P2PSD_ACTION_ID_GAS_CREQ	0x0c
+				/* Action value for GAS Comback Request AF */
+#define	P2PSD_ACTION_ID_GAS_CRESP	0x0d
+				/* Action value for GAS Comback Response AF */
+#define P2PSD_AD_EID				0x6c
+				/* Advertisement Protocol IE ID */
+#define P2PSD_ADP_TUPLE_QLMT_PAMEBI	0x00
+				/* Query Response Length Limit 7 bits plus PAME-BI 1 bit */
+#define P2PSD_ADP_PROTO_ID			0x00
+				/* Advertisement Protocol ID. Always 0 for P2P SD */
+#define P2PSD_GAS_OUI				P2P_OUI
+				/* WFA OUI */
+#define P2PSD_GAS_OUI_SUBTYPE		P2P_VER
+				/* OUI Subtype for GAS IE */
+#define P2PSD_GAS_NQP_INFOID		0xDDDD
+				/* NQP Query Info ID: 56797 */
+#define P2PSD_GAS_COMEBACKDEALY		0x00
+				/* Not used in the Native GAS protocol */
+
+/* Service Protocol Type */
+typedef enum p2psd_svc_protype {
+	SVC_RPOTYPE_ALL = 0,
+	SVC_RPOTYPE_BONJOUR = 1,
+	SVC_RPOTYPE_UPNP = 2,
+	SVC_RPOTYPE_WSD = 3,
+	SVC_RPOTYPE_VENDOR = 255
+} p2psd_svc_protype_t;
+
+/* Service Discovery response status code */
+typedef enum {
+	P2PSD_RESP_STATUS_SUCCESS = 0,
+	P2PSD_RESP_STATUS_PROTYPE_NA = 1,
+	P2PSD_RESP_STATUS_DATA_NA = 2,
+	P2PSD_RESP_STATUS_BAD_REQUEST = 3
+} p2psd_resp_status_t;
+
+/* Advertisement Protocol IE tuple field */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_tpl {
+	uint8	llm_pamebi;	/* Query Response Length Limit bit 0-6, set to 0 plus
+				* Pre-Associated Message Exchange BSSID Independent bit 7, set to 0
+				*/
+	uint8	adp_id;		/* Advertisement Protocol ID: 0 for NQP Native Query Protocol */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_tpl wifi_p2psd_adp_tpl_t;
+
+/* Advertisement Protocol IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_ie {
+	uint8	id;		/* IE ID: 0x6c - 108 */
+	uint8	len;	/* IE length */
+	wifi_p2psd_adp_tpl_t adp_tpl;  /* Advertisement Protocol Tuple field. Only one
+				* tuple is defined for P2P Service Discovery
+				*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_ie wifi_p2psd_adp_ie_t;
+
+/* NQP Vendor-specific Content */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_nqp_query_vsc {
+	uint8	oui_subtype;	/* OUI Subtype: 0x09 */
+	uint16	svc_updi;		/* Service Update Indicator */
+	uint8	svc_tlvs[1];	/* wifi_p2psd_qreq_tlv_t type for service request,
+				* wifi_p2psd_qresp_tlv_t type for service response
+				*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_nqp_query_vsc wifi_p2psd_nqp_query_vsc_t;
+
+/* Service Request TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_tlv {
+	uint16	len;			/* Length: 5 plus size of Query Data */
+	uint8	svc_prot;		/* Service Protocol Type */
+	uint8	svc_tscid;		/* Service Transaction ID */
+	uint8	query_data[1];	/* Query Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_tlv wifi_p2psd_qreq_tlv_t;
+
+/* Query Request Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_frame {
+	uint16	info_id;	/* Info ID: 0xDDDD */
+	uint16	len;		/* Length of service request TLV, 5 plus the size of request data */
+	uint8	oui[3];		/* WFA OUI: 0x0050F2 */
+	uint8	qreq_vsc[1]; /* Vendor-specific Content: wifi_p2psd_nqp_query_vsc_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_frame wifi_p2psd_qreq_frame_t;
+
+/* GAS Initial Request AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_ireq_frame {
+	wifi_p2psd_adp_ie_t		adp_ie;		/* Advertisement Protocol IE */
+	uint16					qreq_len;	/* Query Request Length */
+	uint8	qreq_frm[1];	/* Query Request Frame wifi_p2psd_qreq_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_ireq_frame wifi_p2psd_gas_ireq_frame_t;
+
+/* Service Response TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_tlv {
+	uint16	len;				/* Length: 5 plus size of Query Data */
+	uint8	svc_prot;			/* Service Protocol Type */
+	uint8	svc_tscid;			/* Service Transaction ID */
+	uint8	status;				/* Value defined in Table 57 of P2P spec. */
+	uint8	query_data[1];		/* Response Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_tlv wifi_p2psd_qresp_tlv_t;
+
+/* Query Response Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_frame {
+	uint16	info_id;	/* Info ID: 0xDDDD */
+	uint16	len;		/* Lenth of service response TLV, 6 plus the size of resp data */
+	uint8	oui[3];		/* WFA OUI: 0x0050F2 */
+	uint8	qresp_vsc[1]; /* Vendor-specific Content: wifi_p2psd_qresp_tlv_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_frame wifi_p2psd_qresp_frame_t;
+
+/* GAS Initial Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_iresp_frame {
+	uint16	status;			/* Value defined in Table 7-23 of IEEE P802.11u */
+	uint16	cb_delay;		/* GAS Comeback Delay */
+	wifi_p2psd_adp_ie_t	adp_ie;		/* Advertisement Protocol IE */
+	uint16		qresp_len;	/* Query Response Length */
+	uint8	qresp_frm[1];	/* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_iresp_frame wifi_p2psd_gas_iresp_frame_t;
+
+/* GAS Comeback Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_cresp_frame {
+	uint16	status;			/* Value defined in Table 7-23 of IEEE P802.11u */
+	uint8	fragment_id;	/* Fragmentation ID */
+	uint16	cb_delay;		/* GAS Comeback Delay */
+	wifi_p2psd_adp_ie_t	adp_ie;		/* Advertisement Protocol IE */
+	uint16	qresp_len;		/* Query Response Length */
+	uint8	qresp_frm[1];	/* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_cresp_frame wifi_p2psd_gas_cresp_frame_t;
+
+/* Wi-Fi GAS Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_pub_act_frame {
+	uint8	category;		/* 0x04 Public Action Frame */
+	uint8	action;			/* 0x6c Advertisement Protocol */
+	uint8	dialog_token;	/* nonzero, identifies req/rsp transaction */
+	uint8	query_data[1];	/* Query Data. wifi_p2psd_gas_ireq_frame_t
+					 * or wifi_p2psd_gas_iresp_frame_t format
+					 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_pub_act_frame wifi_p2psd_gas_pub_act_frame_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _P2P_H_ */
diff --git a/bcmdhd/dhdutil/include/proto/vlan.h b/bcmdhd/dhdutil/include/proto/vlan.h
index 6cba7fb..d77b36e 100644
--- a/bcmdhd/dhdutil/include/proto/vlan.h
+++ b/bcmdhd/dhdutil/include/proto/vlan.h
@@ -1,8 +1,8 @@
 /*
  * 802.1Q VLAN protocol definitions
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,10 +15,9 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: vlan.h,v 9.7 2009-03-13 01:11:50 Exp $
+ * $Id: vlan.h 382883 2013-02-04 23:26:09Z $
  */
 
-
 #ifndef _vlan_h_
 #define _vlan_h_
 
@@ -26,32 +25,58 @@
 #include <typedefs.h>
 #endif
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
-#define VLAN_VID_MASK		0xfff
-#define	VLAN_CFI_SHIFT		12
-#define VLAN_PRI_SHIFT		13
+#ifndef	 VLAN_VID_MASK
+#define VLAN_VID_MASK		0xfff	/* low 12 bits are vlan id */
+#endif
+
+#define	VLAN_CFI_SHIFT		12	/* canonical format indicator bit */
+#define VLAN_PRI_SHIFT		13	/* user priority */
+
+#define VLAN_PRI_MASK		7	/* 3 bits of priority */
 
-#define VLAN_PRI_MASK		7
+#define	VLAN_TPID_OFFSET	12	/* offset of tag protocol id field */
+#define	VLAN_TCI_OFFSET		14	/* offset of tag ctrl info field */
 
 #define	VLAN_TAG_LEN		4
-#define	VLAN_TAG_OFFSET		(2 * ETHER_ADDR_LEN)
+#define	VLAN_TAG_OFFSET		(2 * ETHER_ADDR_LEN)	/* offset in Ethernet II packet only */
 
-#define VLAN_TPID		0x8100
+#define VLAN_TPID		0x8100	/* VLAN ethertype/Tag Protocol ID */
+
+struct vlan_header {
+	uint16	vlan_type;		/* 0x8100 */
+	uint16	vlan_tag;		/* priority, cfi and vid */
+};
 
 struct ethervlan_header {
 	uint8	ether_dhost[ETHER_ADDR_LEN];
 	uint8	ether_shost[ETHER_ADDR_LEN];
-	uint16	vlan_type;
-	uint16	vlan_tag;
+	uint16	vlan_type;		/* 0x8100 */
+	uint16	vlan_tag;		/* priority, cfi and vid */
 	uint16	ether_type;
 };
 
-#define	ETHERVLAN_HDR_LEN	(ETHER_HDR_LEN + VLAN_TAG_LEN)
+struct dot3_mac_llc_snapvlan_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];	/* dest mac */
+	uint8	ether_shost[ETHER_ADDR_LEN];	/* src mac */
+	uint16	length;				/* frame length incl header */
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[3];				/* RFC1042: 0x00 0x00 0x00
+						 * Bridge-Tunnel: 0x00 0x00 0xF8
+						 */
+	uint16	vlan_type;			/* 0x8100 */
+	uint16	vlan_tag;			/* priority, cfi and vid */
+	uint16	ether_type;			/* ethertype */
+};
 
+#define	ETHERVLAN_HDR_LEN	(ETHER_HDR_LEN + VLAN_TAG_LEN)
 
 
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
 #define ETHERVLAN_MOVE_HDR(d, s) \
@@ -61,4 +86,4 @@ do { \
 	*(struct ethervlan_header *)(d) = t; \
 } while (0)
 
-#endif
+#endif /* _vlan_h_ */
diff --git a/bcmdhd/dhdutil/include/proto/wpa.h b/bcmdhd/dhdutil/include/proto/wpa.h
index 32dff96..6953b33 100644
--- a/bcmdhd/dhdutil/include/proto/wpa.h
+++ b/bcmdhd/dhdutil/include/proto/wpa.h
@@ -1,8 +1,8 @@
 /*
  * Fundamental types and constants relating to WPA
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,10 +15,9 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: wpa.h 261155 2011-05-23 23:51:32Z $
+ * $Id: wpa.h 384536 2013-02-12 04:13:09Z $
  */
 
-
 #ifndef _proto_wpa_h_
 #define _proto_wpa_h_
 
@@ -26,55 +25,57 @@
 #include <proto/ethernet.h>
 
 
-
+/* This marks the start of a packed structure section. */
 #include <packed_section_start.h>
 
-
-
-
-#define DOT11_RC_INVALID_WPA_IE		13
-#define DOT11_RC_MIC_FAILURE		14
-#define DOT11_RC_4WH_TIMEOUT		15
-#define DOT11_RC_GTK_UPDATE_TIMEOUT	16
-#define DOT11_RC_WPA_IE_MISMATCH	17
-#define DOT11_RC_INVALID_MC_CIPHER	18
-#define DOT11_RC_INVALID_UC_CIPHER	19
-#define DOT11_RC_INVALID_AKMP		20
-#define DOT11_RC_BAD_WPA_VERSION	21
-#define DOT11_RC_INVALID_WPA_CAP	22
-#define DOT11_RC_8021X_AUTH_FAIL	23
+/* Reason Codes */
+
+/* 13 through 23 taken from IEEE Std 802.11i-2004 */
+#define DOT11_RC_INVALID_WPA_IE		13	/* Invalid info. element */
+#define DOT11_RC_MIC_FAILURE		14	/* Michael failure */
+#define DOT11_RC_4WH_TIMEOUT		15	/* 4-way handshake timeout */
+#define DOT11_RC_GTK_UPDATE_TIMEOUT	16	/* Group key update timeout */
+#define DOT11_RC_WPA_IE_MISMATCH	17	/* WPA IE in 4-way handshake differs from
+						 * (re-)assoc. request/probe response
+						 */
+#define DOT11_RC_INVALID_MC_CIPHER	18	/* Invalid multicast cipher */
+#define DOT11_RC_INVALID_UC_CIPHER	19	/* Invalid unicast cipher */
+#define DOT11_RC_INVALID_AKMP		20	/* Invalid authenticated key management protocol */
+#define DOT11_RC_BAD_WPA_VERSION	21	/* Unsupported WPA version */
+#define DOT11_RC_INVALID_WPA_CAP	22	/* Invalid WPA IE capabilities */
+#define DOT11_RC_8021X_AUTH_FAIL	23	/* 802.1X authentication failure */
 
 #define WPA2_PMKID_LEN	16
 
-
+/* WPA IE fixed portion */
 typedef BWL_PRE_PACKED_STRUCT struct
 {
-	uint8 tag;
-	uint8 length;
-	uint8 oui[3];
-	uint8 oui_type;
+	uint8 tag;	/* TAG */
+	uint8 length;	/* TAG length */
+	uint8 oui[3];	/* IE OUI */
+	uint8 oui_type;	/* OUI type */
 	BWL_PRE_PACKED_STRUCT struct {
 		uint8 low;
 		uint8 high;
-	} BWL_POST_PACKED_STRUCT version;
+	} BWL_POST_PACKED_STRUCT version;	/* IE version */
 } BWL_POST_PACKED_STRUCT wpa_ie_fixed_t;
 #define WPA_IE_OUITYPE_LEN	4
 #define WPA_IE_FIXED_LEN	8
 #define WPA_IE_TAG_FIXED_LEN	6
 
 typedef BWL_PRE_PACKED_STRUCT struct {
-	uint8 tag;
-	uint8 length;
+	uint8 tag;	/* TAG */
+	uint8 length;	/* TAG length */
 	BWL_PRE_PACKED_STRUCT struct {
 		uint8 low;
 		uint8 high;
-	} BWL_POST_PACKED_STRUCT version;
+	} BWL_POST_PACKED_STRUCT version;	/* IE version */
 } BWL_POST_PACKED_STRUCT wpa_rsn_ie_fixed_t;
 #define WPA_RSN_IE_FIXED_LEN	4
 #define WPA_RSN_IE_TAG_FIXED_LEN	2
 typedef uint8 wpa_pmkid_t[WPA2_PMKID_LEN];
 
-
+/* WPA suite/multicast suite */
 typedef BWL_PRE_PACKED_STRUCT struct
 {
 	uint8 oui[3];
@@ -82,7 +83,7 @@ typedef BWL_PRE_PACKED_STRUCT struct
 } BWL_POST_PACKED_STRUCT wpa_suite_t, wpa_suite_mcast_t;
 #define WPA_SUITE_LEN	4
 
-
+/* WPA unicast suite list/key management suite list */
 typedef BWL_PRE_PACKED_STRUCT struct
 {
 	BWL_PRE_PACKED_STRUCT struct {
@@ -101,22 +102,16 @@ typedef BWL_PRE_PACKED_STRUCT struct
 	wpa_pmkid_t list[1];
 } BWL_POST_PACKED_STRUCT wpa_pmkid_list_t;
 
+/* WPA cipher suites */
+#define WPA_CIPHER_NONE		0	/* None */
+#define WPA_CIPHER_WEP_40	1	/* WEP (40-bit) */
+#define WPA_CIPHER_TKIP		2	/* TKIP: default for WPA */
+#define WPA_CIPHER_AES_OCB	3	/* AES (OCB) */
+#define WPA_CIPHER_AES_CCM	4	/* AES (CCM) */
+#define WPA_CIPHER_WEP_104	5	/* WEP (104-bit) */
+#define WPA_CIPHER_BIP		6	/* WEP (104-bit) */
+#define WPA_CIPHER_TPK		7	/* Group addressed traffic not allowed */
 
-#define WPA_CIPHER_NONE		0
-#define WPA_CIPHER_WEP_40	1
-#define WPA_CIPHER_TKIP		2
-#define WPA_CIPHER_AES_OCB	3
-#define WPA_CIPHER_AES_CCM	4
-#define WPA_CIPHER_WEP_104	5
-#define WPA_CIPHER_BIP		6	
-#define WPA_CIPHER_TPK		7	
-
-#ifdef BCMWAPI_WAI
-#define WAPI_CIPHER_NONE	WPA_CIPHER_NONE
-#define WAPI_CIPHER_SMS4	11
-
-#define WAPI_CSE_WPI_SMS4	1
-#endif 
 
 #define IS_WPA_CIPHER(cipher)	((cipher) == WPA_CIPHER_NONE || \
 				 (cipher) == WPA_CIPHER_WEP_40 || \
@@ -127,13 +122,14 @@ typedef BWL_PRE_PACKED_STRUCT struct
 				 (cipher) == WPA_CIPHER_TPK)
 
 
-#define WPA_TKIP_CM_DETECT	60
-#define WPA_TKIP_CM_BLOCK	60
-
-
-#define RSN_CAP_LEN		2
+/* WPA TKIP countermeasures parameters */
+#define WPA_TKIP_CM_DETECT	60	/* multiple MIC failure window (seconds) */
+#define WPA_TKIP_CM_BLOCK	60	/* countermeasures active window (seconds) */
 
+/* RSN IE defines */
+#define RSN_CAP_LEN		2	/* Length of RSN capabilities field (2 octets) */
 
+/* RSN Capabilities defined in 802.11i */
 #define RSN_CAP_PREAUTH			0x0001
 #define RSN_CAP_NOPAIRWISE		0x0002
 #define RSN_CAP_PTK_REPLAY_CNTR_MASK	0x000C
@@ -144,20 +140,30 @@ typedef BWL_PRE_PACKED_STRUCT struct
 #define RSN_CAP_2_REPLAY_CNTRS		1
 #define RSN_CAP_4_REPLAY_CNTRS		2
 #define RSN_CAP_16_REPLAY_CNTRS		3
+#define RSN_CAP_MFPR			0x0040
+#define RSN_CAP_MFPC			0x0080
+#define RSN_CAP_SPPC			0x0400
+#define RSN_CAP_SPPR			0x0800
 
-
+/* WPA capabilities defined in 802.11i */
 #define WPA_CAP_4_REPLAY_CNTRS		RSN_CAP_4_REPLAY_CNTRS
 #define WPA_CAP_16_REPLAY_CNTRS		RSN_CAP_16_REPLAY_CNTRS
 #define WPA_CAP_REPLAY_CNTR_SHIFT	RSN_CAP_PTK_REPLAY_CNTR_SHIFT
 #define WPA_CAP_REPLAY_CNTR_MASK	RSN_CAP_PTK_REPLAY_CNTR_MASK
 
+/* WPA capabilities defined in 802.11zD9.0 */
+#define WPA_CAP_PEER_KEY_ENABLE		(0x1 << 1)	/* bit 9 */
 
-#define WPA_CAP_LEN	RSN_CAP_LEN
+/* WPA Specific defines */
+#define WPA_CAP_LEN	RSN_CAP_LEN	/* Length of RSN capabilities in RSN IE (2 octets) */
+#define WPA_PMKID_CNT_LEN	2 	/* Length of RSN PMKID count (2 octests) */
 
 #define	WPA_CAP_WPA2_PREAUTH		RSN_CAP_PREAUTH
 
+#define WPA2_PMKID_COUNT_LEN	2
 
 
+/* This marks the end of a packed structure section. */
 #include <packed_section_end.h>
 
-#endif
+#endif /* _proto_wpa_h_ */
diff --git a/bcmdhd/dhdutil/include/sdiovar.h b/bcmdhd/dhdutil/include/sdiovar.h
index e8ce8f2..c59d839 100644
--- a/bcmdhd/dhdutil/include/sdiovar.h
+++ b/bcmdhd/dhdutil/include/sdiovar.h
@@ -2,7 +2,7 @@
  * Structure used by apps whose drivers access SDIO drivers.
  * Pulled out separately so dhdu and wlu can both use it.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: sdiovar.h,v 13.9 2009-12-08 22:30:15 Exp $
+ * $Id: sdiovar.h 241182 2011-02-17 21:50:03Z $
  */
 
 #ifndef _sdiovar_h_
diff --git a/bcmdhd/dhdutil/include/trxhdr.h b/bcmdhd/dhdutil/include/trxhdr.h
index a1e29fb..084900f 100644
--- a/bcmdhd/dhdutil/include/trxhdr.h
+++ b/bcmdhd/dhdutil/include/trxhdr.h
@@ -1,7 +1,7 @@
 /*
  * TRX image file header format.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: trxhdr.h 260898 2011-05-20 23:11:12Z $
+ * $Id: trxhdr.h 349211 2012-08-07 09:45:24Z $
  */
 
 #ifndef _TRX_HDR_H
@@ -24,23 +24,62 @@
 #include <typedefs.h>
 
 #define TRX_MAGIC	0x30524448	/* "HDR0" */
-#define TRX_VERSION	1		/* Version 1 */
 #define TRX_MAX_LEN	0x3B0000	/* Max length */
 #define TRX_NO_HEADER	1		/* Do not write TRX header */
 #define TRX_GZ_FILES	0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
 #define TRX_EMBED_UCODE	0x8	/* Trx contains embedded ucode image */
 #define TRX_ROMSIM_IMAGE	0x10	/* Trx contains ROM simulation image */
 #define TRX_UNCOMP_IMAGE	0x20	/* Trx contains uncompressed rtecdc.bin image */
-#define TRX_MAX_OFFSET	3		/* Max number of individual files */
+#define TRX_BOOTLOADER		0x40	/* the image is a bootloader */
 
+#define TRX_V1		1
+#define TRX_V1_MAX_OFFSETS	3		/* V1: Max number of individual files */
+
+#ifndef BCMTRXV2
+#define TRX_VERSION	TRX_V1		/* Version 1 */
+#define TRX_MAX_OFFSET TRX_V1_MAX_OFFSETS
+#endif
+
+/* BMAC Host driver/application like bcmdl need to support both Ver 1 as well as
+ * Ver 2 of trx header. To make it generic, trx_header is structure is modified
+ * as below where size of "offsets" field will vary as per the TRX version.
+ * Currently, BMAC host driver and bcmdl are modified to support TRXV2 as well.
+ * To make sure, other applications like "dhdl" which are yet to be enhanced to support
+ * TRXV2 are not broken, new macro and structure defintion take effect only when BCMTRXV2
+ * is defined.
+ */
 struct trx_header {
 	uint32 magic;		/* "HDR0" */
 	uint32 len;		/* Length of file including header */
 	uint32 crc32;		/* 32-bit CRC from flag_version to end of file */
 	uint32 flag_version;	/* 0:15 flags, 16:31 version */
+#ifndef BCMTRXV2
 	uint32 offsets[TRX_MAX_OFFSET];	/* Offsets of partitions from start of header */
+#else
+	uint32 offsets[1];	/* Offsets of partitions from start of header */
+#endif
 };
 
+#ifdef BCMTRXV2
+#define TRX_VERSION		TRX_V2		/* Version 2 */
+#define TRX_MAX_OFFSET  TRX_V2_MAX_OFFSETS
+
+#define TRX_V2		2
+/* V2: Max number of individual files
+ * To support SDR signature + Config data region
+ */
+#define TRX_V2_MAX_OFFSETS	5
+#define SIZEOF_TRXHDR_V1	(sizeof(struct trx_header)+(TRX_V1_MAX_OFFSETS-1)*sizeof(uint32))
+#define SIZEOF_TRXHDR_V2	(sizeof(struct trx_header)+(TRX_V2_MAX_OFFSETS-1)*sizeof(uint32))
+#define TRX_VER(trx)		(trx->flag_version>>16)
+#define ISTRX_V1(trx)		(TRX_VER(trx) == TRX_V1)
+#define ISTRX_V2(trx)		(TRX_VER(trx) == TRX_V2)
+/* For V2, return size of V2 size: others, return V1 size */
+#define SIZEOF_TRX(trx)	    (ISTRX_V2(trx) ? SIZEOF_TRXHDR_V2: SIZEOF_TRXHDR_V1)
+#else
+#define SIZEOF_TRX(trx)	    (sizeof(struct trx_header))
+#endif /* BCMTRXV2 */
+
 /* Compatibility */
 typedef struct trx_header TRXHDR, *PTRXHDR;
 
diff --git a/bcmdhd/dhdutil/include/typedefs.h b/bcmdhd/dhdutil/include/typedefs.h
index e63133f..4c8d30c 100644
--- a/bcmdhd/dhdutil/include/typedefs.h
+++ b/bcmdhd/dhdutil/include/typedefs.h
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 1999-2012, Broadcom Corporation
- *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -16,19 +16,34 @@
  * $Id: typedefs.h 286783 2011-09-29 06:18:57Z $
  */
 
-
 #ifndef _TYPEDEFS_H_
 #define _TYPEDEFS_H_
 
 #ifdef SITE_TYPEDEFS
 
-
+/*
+ * Define SITE_TYPEDEFS in the compile to include a site-specific
+ * typedef file "site_typedefs.h".
+ *
+ * If SITE_TYPEDEFS is not defined, then the code section below makes
+ * inferences about the compile environment based on defined symbols and
+ * possibly compiler pragmas.
+ *
+ * Following these two sections is the Default Typedefs section.
+ * This section is only processed if USE_TYPEDEF_DEFAULTS is
+ * defined. This section has a default set of typedefs and a few
+ * preprocessor symbols (TRUE, FALSE, NULL, ...).
+ */
 
 #include "site_typedefs.h"
 
 #else
 
-
+/*
+ * Infer the compile environment based on preprocessor symbols and pragmas.
+ * Override type definitions as needed, and include configuration-dependent
+ * header files to define types.
+ */
 
 #ifdef __cplusplus
 
@@ -40,10 +55,10 @@
 #define TRUE	true
 #endif
 
-#else
+#else	/* ! __cplusplus */
 
 
-#endif
+#endif	/* ! __cplusplus */
 
 #if defined(__x86_64__)
 #define TYPEDEF_UINTPTR
@@ -61,44 +76,51 @@ typedef long unsigned int size_t;
 
 
 
-
 #if defined(__sparc__)
 #define TYPEDEF_ULONG
 #endif
 
 
-
+/*
+ * If this is either a Linux hybrid build or the per-port code of a hybrid build
+ * then use the Linux header files to get some of the typedefs.  Otherwise, define
+ * them entirely in this file.  We can't always define the types because we get
+ * a duplicate typedef error; there is no way to "undefine" a typedef.
+ * We know when it's per-port code because each file defines LINUX_PORT at the top.
+ */
 #if !defined(LINUX_HYBRID) || defined(LINUX_PORT)
 #define TYPEDEF_UINT
 #ifndef TARGETENV_android
 #define TYPEDEF_USHORT
 #define TYPEDEF_ULONG
-#endif
+#endif /* TARGETENV_android */
 #ifdef __KERNEL__
 #include <linux/version.h>
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
 #define TYPEDEF_BOOL
-#endif
-
+#endif	/* >= 2.6.19 */
+/* special detection for 2.6.18-128.7.1.0.1.el5 */
 #if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
 #include <linux/compiler.h>
 #ifdef noinline_for_stack
 #define TYPEDEF_BOOL
 #endif
-#endif
-#endif
-#endif
-
+#endif	/* == 2.6.18 */
+#endif	/* __KERNEL__ */
+#endif  /* !defined(LINUX_HYBRID) || defined(LINUX_PORT) */
 
 
 
 
+/* Do not support the (u)int64 types with strict ansi for GNU C */
 #if defined(__GNUC__) && defined(__STRICT_ANSI__)
 #define TYPEDEF_INT64
 #define TYPEDEF_UINT64
 #endif
 
-
+/* ICL accepts unsigned 64 bit type only, and complains in ANSI mode
+ * for signed or unsigned
+ */
 #if defined(__ICL)
 
 #define TYPEDEF_INT64
@@ -107,45 +129,47 @@ typedef long unsigned int size_t;
 #define TYPEDEF_UINT64
 #endif
 
-#endif
+#endif /* __ICL */
 
 #if !defined(__DJGPP__)
 
-
+/* pick up ushort & uint from standard types.h */
 #if defined(__KERNEL__)
 
-
+/* See note above */
 #if !defined(LINUX_HYBRID) || defined(LINUX_PORT)
-#include <linux/types.h>
-#endif
+#include <linux/types.h>	/* sys/types.h and linux/types.h are oil and water */
+#endif /* !defined(LINUX_HYBRID) || defined(LINUX_PORT) */
 
 #else
 
 
 #include <sys/types.h>
 
-#endif
-
-#endif
+#endif /* linux && __KERNEL__ */
 
+#endif 
 
 
 
+/* use the default typedefs in the next section of this file */
 #define USE_TYPEDEF_DEFAULTS
 
-#endif
-
+#endif /* SITE_TYPEDEFS */
 
 
+/*
+ * Default Typedefs
+ */
 
 #ifdef USE_TYPEDEF_DEFAULTS
 #undef USE_TYPEDEF_DEFAULTS
 
 #ifndef TYPEDEF_BOOL
-typedef	 unsigned char	bool;
+typedef	/* @abstract@ */ unsigned char	bool;
 #endif
 
-
+/* define uchar, ushort, uint, ulong */
 
 #ifndef TYPEDEF_UCHAR
 typedef unsigned char	uchar;
@@ -163,7 +187,7 @@ typedef unsigned int	uint;
 typedef unsigned long	ulong;
 #endif
 
-
+/* define [u]int8/16/32/64, uintptr */
 
 #ifndef TYPEDEF_UINT8
 typedef unsigned char	uint8;
@@ -201,7 +225,7 @@ typedef signed int	int32;
 typedef signed long long int64;
 #endif
 
-
+/* define float32/64, float_t */
 
 #ifndef TYPEDEF_FLOAT32
 typedef float		float32;
@@ -211,26 +235,30 @@ typedef float		float32;
 typedef double		float64;
 #endif
 
-
+/*
+ * abstracted floating point type allows for compile time selection of
+ * single or double precision arithmetic.  Compiling with -DFLOAT32
+ * selects single precision; the default is double precision.
+ */
 
 #ifndef TYPEDEF_FLOAT_T
 
 #if defined(FLOAT32)
 typedef float32 float_t;
-#else
+#else /* default to double precision floating point */
 typedef float64 float_t;
 #endif
 
-#endif
-
+#endif /* TYPEDEF_FLOAT_T */
 
+/* define macro values */
 
 #ifndef FALSE
 #define FALSE	0
 #endif
 
 #ifndef TRUE
-#define TRUE	1
+#define TRUE	1  /* TRUE */
 #endif
 
 #ifndef NULL
@@ -242,26 +270,26 @@ typedef float64 float_t;
 #endif
 
 #ifndef ON
-#define	ON	1
+#define	ON	1  /* ON = 1 */
 #endif
 
-#define	AUTO	(-1)
-
+#define	AUTO	(-1) /* Auto = -1 */
 
+/* define PTRSZ, INLINE */
 
 #ifndef PTRSZ
 #define	PTRSZ	sizeof(char*)
 #endif
 
 
-
+/* Detect compiler type. */
 #if defined(__GNUC__) || defined(__lint)
 	#define BWL_COMPILER_GNU
 #elif defined(__CC_ARM) && __CC_ARM
 	#define BWL_COMPILER_ARMCC
 #else
 	#error "Unknown compiler!"
-#endif
+#endif 
 
 
 #ifndef INLINE
@@ -273,8 +301,8 @@ typedef float64 float_t;
 		#define INLINE	__inline
 	#else
 		#define INLINE
-	#endif
-#endif
+	#endif 
+#endif /* INLINE */
 
 #undef TYPEDEF_BOOL
 #undef TYPEDEF_UCHAR
@@ -294,13 +322,17 @@ typedef float64 float_t;
 #undef TYPEDEF_FLOAT64
 #undef TYPEDEF_FLOAT_T
 
-#endif
-
+#endif /* USE_TYPEDEF_DEFAULTS */
 
+/* Suppress unused parameter warning */
 #define UNUSED_PARAMETER(x) (void)(x)
 
-
+/* Avoid warning for discarded const or volatile qualifier in special cases (-Wcast-qual) */
 #define DISCARD_QUAL(ptr, type) ((type *)(uintptr)(ptr))
 
+/*
+ * Including the bcmdefs.h here, to make sure everyone including typedefs.h
+ * gets this automatically
+*/
 #include <bcmdefs.h>
-#endif
+#endif /* _TYPEDEFS_H_ */
diff --git a/bcmdhd/dhdutil/include/wlioctl.h b/bcmdhd/dhdutil/include/wlioctl.h
index d9ebc5e..c6a2b41 100644
--- a/bcmdhd/dhdutil/include/wlioctl.h
+++ b/bcmdhd/dhdutil/include/wlioctl.h
@@ -4,7 +4,7 @@
  *
  * Definitions subject to change without notice.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -18,12 +18,12 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: wlioctl.h 334796 2012-05-23 22:59:44Z $
+ *
+ * $Id: wlioctl.h 386120 2013-02-19 19:25:44Z $
  */
 
-
 #ifndef _wlioctl_h_
-#define _wlioctl_h_
+#define	_wlioctl_h_
 
 #include <typedefs.h>
 #include <proto/ethernet.h>
@@ -33,27 +33,44 @@
 #include <bcmwifi_channels.h>
 #include <bcmwifi_rates.h>
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#include <bcm_mpool_pub.h>
 #include <bcmcdc.h>
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/*  LINUX_POSTMOGRIFY_REMOVAL: undefined during compile phase, so its
+ *  a no-op for most cases. For hybrid and other open source releases,
+ *  its defined during a second pass and mogrified out for distribution.
+ */
+
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 
 #ifndef INTF_NAME_SIZ
-#define INTF_NAME_SIZ   16
+#define INTF_NAME_SIZ	16
 #endif
 
-
+/* Used to send ioctls over the transport pipe */
 typedef struct remote_ioctl {
-	cdc_ioctl_t     msg;
-	uint        data_len;
+	cdc_ioctl_t 	msg;
+	uint		data_len;
 	char            intf_name[INTF_NAME_SIZ];
 } rem_ioctl_t;
-#define REMOTE_SIZE sizeof(rem_ioctl_t)
+#define REMOTE_SIZE	sizeof(rem_ioctl_t)
+
 
-#define ACTION_FRAME_SIZE 1040
+typedef struct {
+	uint32 num;
+	chanspec_t list[1];
+} chanspec_list_t;
+
+#define ACTION_FRAME_SIZE 1800
 
 typedef struct wl_action_frame {
-	struct ether_addr   da;
-	uint16          len;
-	uint32          packetId;
-	uint8           data[ACTION_FRAME_SIZE];
+	struct ether_addr 	da;
+	uint16 			len;
+	uint32 			packetId;
+	uint8			data[ACTION_FRAME_SIZE];
 } wl_action_frame_t;
 
 #define WL_WIFI_ACTION_FRAME_SIZE sizeof(struct wl_action_frame)
@@ -65,10 +82,10 @@ typedef struct ssid_info
 } ssid_info_t;
 
 typedef struct wl_af_params {
-	uint32          channel;
-	int32           dwell_time;
-	struct ether_addr   BSSID;
-	wl_action_frame_t   action_frame;
+	uint32 			channel;
+	int32 			dwell_time;
+	struct ether_addr 	BSSID;
+	wl_action_frame_t	action_frame;
 } wl_af_params_t;
 
 #define WL_WIFI_AF_PARAMS_SIZE sizeof(struct wl_af_params)
@@ -82,10 +99,14 @@ typedef struct wl_sa_query {
 	struct ether_addr 	da;
 } wl_sa_query_t;
 
+#endif /*  LINUX_POSTMOGRIFY_REMOVAL */
+
+/* require default structure packing */
 #define BWL_DEFAULT_PACKING
 #include <packed_section_start.h>
 
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 /* Legacy structure to help keep backward compatible wl tool and tray app */
 
 #define	LEGACY_WL_BSS_INFO_VERSION	107	/* older version of wl_bss_info struct */
@@ -117,68 +138,80 @@ typedef struct wl_bss_info_107 {
  * Per-BSS information structure.
  */
 
-#define LEGACY2_WL_BSS_INFO_VERSION 108
-
+#define	LEGACY2_WL_BSS_INFO_VERSION	108		/* old version of wl_bss_info struct */
 
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
 typedef struct wl_bss_info_108 {
-	uint32      version;
-	uint32      length;
+	uint32		version;		/* version field */
+	uint32		length;			/* byte length of data in this record,
+						 * starting at version and including IEs
+						 */
 	struct ether_addr BSSID;
-	uint16      beacon_period;
-	uint16      capability;
-	uint8       SSID_len;
-	uint8       SSID[32];
+	uint16		beacon_period;		/* units are Kusec */
+	uint16		capability;		/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
 	struct {
-		uint    count;
-		uint8   rates[16];
-	} rateset;
-	chanspec_t  chanspec;
-	uint16      atim_window;
-	uint8       dtim_period;
-	int16       RSSI;
-	int8        phy_noise;
-
-	uint8       n_cap;
-	uint32      nbss_cap;
-	uint8       ctl_ch;
-	uint32      reserved32[1];
-	uint8       flags;
-	uint8       reserved[3];
-	uint8       basic_mcs[MCSSET_LEN];
-
-	uint16      ie_offset;
-	uint32      ie_length;
+		uint	count;			/* # rates in this set */
+		uint8	rates[16];		/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/* supported rates */
+	chanspec_t	chanspec;		/* chanspec for bss */
+	uint16		atim_window;		/* units are Kusec */
+	uint8		dtim_period;		/* DTIM period */
+	int16		RSSI;			/* receive signal strength (in dBm) */
+	int8		phy_noise;		/* noise (in dBm) */
 
+	uint8		n_cap;			/* BSS is 802.11N Capable */
+	uint32		nbss_cap;		/* 802.11N BSS Capabilities (based on HT_CAP_*) */
+	uint8		ctl_ch;			/* 802.11N BSS control channel number */
+	uint32		reserved32[1];		/* Reserved for expansion of BSS properties */
+	uint8		flags;			/* flags */
+	uint8		reserved[3];		/* Reserved for expansion of BSS properties */
+	uint8		basic_mcs[MCSSET_LEN];	/* 802.11N BSS required MCS set */
 
+	uint16		ie_offset;		/* offset at which IEs start, from beginning */
+	uint32		ie_length;		/* byte length of Information Elements */
+	/* Add new fields here */
+	/* variable length Information Elements */
 } wl_bss_info_108_t;
 
-#define WL_BSS_INFO_VERSION 109
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
+#define	WL_BSS_INFO_VERSION	109		/* current version of wl_bss_info struct */
 
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
 typedef struct wl_bss_info {
-	uint32      version;
-	uint32      length;
+	uint32		version;		/* version field */
+	uint32		length;			/* byte length of data in this record,
+						 * starting at version and including IEs
+						 */
 	struct ether_addr BSSID;
-	uint16      beacon_period;
-	uint16      capability;
-	uint8       SSID_len;
-	uint8       SSID[32];
+	uint16		beacon_period;		/* units are Kusec */
+	uint16		capability;		/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
 	struct {
-		uint    count;
-		uint8   rates[16];
-	} rateset;
-	chanspec_t  chanspec;
-	uint16      atim_window;
-	uint8       dtim_period;
-	int16       RSSI;
-	int8        phy_noise;
-
-	uint8       n_cap;
-	uint32      nbss_cap;
-	uint8       ctl_ch;
+		uint	count;			/* # rates in this set */
+		uint8	rates[16];		/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/* supported rates */
+	chanspec_t	chanspec;		/* chanspec for bss */
+	uint16		atim_window;		/* units are Kusec */
+	uint8		dtim_period;		/* DTIM period */
+	int16		RSSI;			/* receive signal strength (in dBm) */
+	int8		phy_noise;		/* noise (in dBm) */
+
+	uint8		n_cap;			/* BSS is 802.11N Capable */
+	uint32		nbss_cap;		/* 802.11N+AC BSS Capabilities */
+	uint8		ctl_ch;			/* 802.11N BSS control channel number */
 	uint8		padding1[3];		/* explicit struct alignment padding */
-	uint16		vht_rxmcsmap;		/* VHT rx mcs map */
-	uint16		vht_txmcsmap;		/* VHT tx mcs map */
+	uint16		vht_rxmcsmap;		/* VHT rx mcs map (802.11ac VHT_CAP_MCS_MAP_*) */
+	uint16		vht_txmcsmap;		/* VHT tx mcs map (802.11ac VHT_CAP_MCS_MAP_*) */
 	uint8		flags;			/* flags */
 	uint8		vht_cap;		/* BSS is vht capable */
 	uint8		reserved[2];		/* Reserved for expansion of BSS properties */
@@ -198,24 +231,27 @@ typedef struct wl_bss_info {
 
 /* bssinfo flag for nbss_cap */
 #define VHT_BI_SGI_80MHZ			0x00000100
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
 typedef struct wl_bsscfg {
-	uint32  wsec;
-	uint32  WPA_auth;
-	uint32  wsec_index;
-	uint32  associated;
-	uint32  BSS;
-	uint32  phytest_on;
-	struct ether_addr   prev_BSSID;
-	struct ether_addr   BSSID;
+	uint32	wsec;
+	uint32	WPA_auth;
+	uint32	wsec_index;
+	uint32	associated;
+	uint32	BSS;
+	uint32	phytest_on;
+	struct ether_addr	prev_BSSID;
+	struct ether_addr	BSSID;
 	uint32  targetbss_wpa2_flags;
 	uint32 assoc_type;
 	uint32 assoc_state;
 } wl_bsscfg_t;
 
 typedef struct wl_bss_config {
-	uint32  atim_window;
-	uint32  beacon_period;
-	uint32  chanspec;
+	uint32	atim_window;
+	uint32	beacon_period;
+	uint32	chanspec;
 } wl_bss_config_t;
 
 #define DLOAD_HANDLER_VER			1	/* Downloader version */
@@ -265,11 +301,14 @@ struct wl_clm_dload_info {
 };
 typedef struct wl_clm_dload_info wl_clm_dload_info_t;
 
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
 typedef struct wlc_ssid {
-	uint32      SSID_len;
-	uchar       SSID[32];
+	uint32		SSID_len;
+	uchar		SSID[DOT11_MAX_SSID_LEN];
 } wlc_ssid_t;
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 
 #define MAX_PREFERRED_AP_NUM     5
 typedef struct wlc_fastssidinfo {
@@ -320,26 +359,49 @@ typedef struct wl_extdscan_params {
 #define WL_SCANFLAGS_PASSIVE	0x01	/* force passive scan */
 #define WL_SCANFLAGS_RESERVED	0x02	/* Reserved */
 #define WL_SCANFLAGS_PROHIBITED	0x04	/* allow scanning prohibited channels */
+#define WL_SCANFLAGS_OFFCHAN	0x08	/* allow scanning/reporting off-channel APs */
+#define WL_SCANFLAGS_HOTSPOT	0x10	/* automatic ANQP to hotspot APs */
 
 #define WL_SCAN_PARAMS_SSID_MAX 	10
 
 typedef struct wl_scan_params {
-	wlc_ssid_t ssid;
-	struct ether_addr bssid;
-	int8 bss_type;
-	uint8 scan_type;
-	int32 nprobes;
-	int32 active_time;
-	int32 passive_time;
-	int32 home_time;
-	int32 channel_num;
-	uint16 channel_list[1];
+	wlc_ssid_t ssid;		/* default: {0, ""} */
+	struct ether_addr bssid;	/* default: bcast */
+	int8 bss_type;			/* default: any,
+					 * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+					 */
+	uint8 scan_type;		/* flags, 0 use default */
+	int32 nprobes;			/* -1 use default, number of probes per channel */
+	int32 active_time;		/* -1 use default, dwell time per channel for
+					 * active scanning
+					 */
+	int32 passive_time;		/* -1 use default, dwell time per channel
+					 * for passive scanning
+					 */
+	int32 home_time;		/* -1 use default, dwell time for the home channel
+					 * between channel scans
+					 */
+	int32 channel_num;		/* count of channels and ssids that follow
+					 *
+					 * low half is count of channels in channel_list, 0
+					 * means default (use all available channels)
+					 *
+					 * high half is entries in wlc_ssid_t array that
+					 * follows channel_list, aligned for int32 (4 bytes)
+					 * meaning an odd channel count implies a 2-byte pad
+					 * between end of channel_list and first ssid
+					 *
+					 * if ssid count is zero, single ssid in the fixed
+					 * parameter portion is assumed, otherwise ssid in
+					 * the fixed portion is ignored
+					 */
+	uint16 channel_list[1];		/* list of chanspecs */
 } wl_scan_params_t;
 
-
+/* size of wl_scan_params not including variable length array */
 #define WL_SCAN_PARAMS_FIXED_SIZE 64
 
-
+/* masks for channel and ssid count */
 #define WL_SCAN_PARAMS_COUNT_MASK 0x0000ffff
 #define WL_SCAN_PARAMS_NSSID_SHIFT 16
 
@@ -349,7 +411,7 @@ typedef struct wl_scan_params {
 
 #define ISCAN_REQ_VERSION 1
 
-
+/* incremental scan struct */
 typedef struct wl_iscan_params {
 	uint32 version;
 	uint16 action;
@@ -357,8 +419,9 @@ typedef struct wl_iscan_params {
 	wl_scan_params_t params;
 } wl_iscan_params_t;
 
-
+/* 3 fields + size of wl_scan_params, not including variable length array */
 #define WL_ISCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_iscan_params_t, params) + sizeof(wlc_ssid_t))
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
 typedef struct wl_scan_results {
 	uint32 buflen;
@@ -367,32 +430,20 @@ typedef struct wl_scan_results {
 	wl_bss_info_t bss_info[1];
 } wl_scan_results_t;
 
-
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* size of wl_scan_results not including variable length array */
 #define WL_SCAN_RESULTS_FIXED_SIZE (sizeof(wl_scan_results_t) - sizeof(wl_bss_info_t))
 
-
-#define WL_SCAN_RESULTS_SUCCESS 0
-#define WL_SCAN_RESULTS_PARTIAL 1
-#define WL_SCAN_RESULTS_PENDING 2
-#define WL_SCAN_RESULTS_ABORTED 3
+/* wl_iscan_results status values */
+#define WL_SCAN_RESULTS_SUCCESS	0
+#define WL_SCAN_RESULTS_PARTIAL	1
+#define WL_SCAN_RESULTS_PENDING	2
+#define WL_SCAN_RESULTS_ABORTED	3
 #define WL_SCAN_RESULTS_NO_MEM  4
 
-
+/* Used in EXT_STA */
 #define DNGL_RXCTXT_SIZE	45
 
-#if defined(SIMPLE_ISCAN)
-#define ISCAN_RETRY_CNT   5
-#define ISCAN_STATE_IDLE   0
-#define ISCAN_STATE_SCANING 1
-#define ISCAN_STATE_PENDING 2
-
-
-#define WLC_IW_ISCAN_MAXLEN   2048
-typedef struct iscan_buf {
-	struct iscan_buf * next;
-	char   iscan_buf[WLC_IW_ISCAN_MAXLEN];
-} iscan_buf_t;
-#endif
 
 #define ESCAN_REQ_VERSION 1
 
@@ -415,13 +466,13 @@ typedef struct wl_escan_result {
 
 #define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(wl_escan_result_t) - sizeof(wl_bss_info_t))
 
-
+/* incremental scan results struct */
 typedef struct wl_iscan_results {
 	uint32 status;
 	wl_scan_results_t results;
 } wl_iscan_results_t;
 
-
+/* size of wl_iscan_results not including variable length array */
 #define WL_ISCAN_RESULTS_FIXED_SIZE \
 	(WL_SCAN_RESULTS_FIXED_SIZE + OFFSETOF(wl_iscan_results_t, results))
 
@@ -430,6 +481,7 @@ typedef struct wl_probe_params {
 	struct ether_addr bssid;
 	struct ether_addr mac;
 } wl_probe_params_t;
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
 #define WL_MAXRATES_IN_SET		16	/* max # of rates in a rateset */
 typedef struct wl_rateset {
@@ -441,19 +493,24 @@ typedef struct wl_rateset_args {
 	uint32	count;			/* # rates in this set */
 	uint8	rates[WL_MAXRATES_IN_SET];	/* rates in 500kbps units w/hi bit set if basic */
 	uint8   mcs[MCSSET_LEN];        /* supported mcs index bit map */
+	uint16 vht_mcs[VHT_CAP_MCS_MAP_NSS_MAX]; /* supported mcs index bit map per nss */
 } wl_rateset_args_t;
 
-
+/* uint32 list */
 typedef struct wl_uint32_list {
-
+	/* in - # of elements, out - # of entries */
 	uint32 count;
-
+	/* variable length uint32 list */
 	uint32 element[1];
 } wl_uint32_list_t;
 
-
+/* used for association with a specific BSSID and chanspec list */
 typedef struct wl_assoc_params {
 	struct ether_addr bssid;	/* 00:00:00:00:00:00: broadcast scan */
+	uint16 bssid_cnt;		/* 0: use chanspec_num, and the single bssid,
+					 * otherwise count of chanspecs in chanspec_list
+					 * AND paired bssids following chanspec_list
+					 */
 	int32 chanspec_num;		/* 0: all available channels,
 					 * otherwise count of chanspecs in chanspec_list
 					 */
@@ -461,116 +518,183 @@ typedef struct wl_assoc_params {
 } wl_assoc_params_t;
 #define WL_ASSOC_PARAMS_FIXED_SIZE 	OFFSETOF(wl_assoc_params_t, chanspec_list)
 
-
+/* used for reassociation/roam to a specific BSSID and channel */
 typedef wl_assoc_params_t wl_reassoc_params_t;
-#define WL_REASSOC_PARAMS_FIXED_SIZE    WL_ASSOC_PARAMS_FIXED_SIZE
-
+#define WL_REASSOC_PARAMS_FIXED_SIZE	WL_ASSOC_PARAMS_FIXED_SIZE
 
+/* used for association to a specific BSSID and channel */
 typedef wl_assoc_params_t wl_join_assoc_params_t;
-#define WL_JOIN_ASSOC_PARAMS_FIXED_SIZE        WL_ASSOC_PARAMS_FIXED_SIZE
-
+#define WL_JOIN_ASSOC_PARAMS_FIXED_SIZE	WL_ASSOC_PARAMS_FIXED_SIZE
 
+/* used for join with or without a specific bssid and channel list */
 typedef struct wl_join_params {
 	wlc_ssid_t ssid;
-	wl_assoc_params_t params;
+	wl_assoc_params_t params;	/* optional field, but it must include the fixed portion
+					 * of the wl_assoc_params_t struct when it does present.
+					 */
 } wl_join_params_t;
 
+#ifndef  LINUX_POSTMOGRIFY_REMOVAL
 #define WL_JOIN_PARAMS_FIXED_SIZE 	(OFFSETOF(wl_join_params_t, params) + \
 					 WL_ASSOC_PARAMS_FIXED_SIZE)
+/* scan params for extended join */
 typedef struct wl_join_scan_params {
-	uint8 scan_type;
-	int32 nprobes;
-	int32 active_time;
-	int32 passive_time;
-	int32 home_time;
+	uint8 scan_type;		/* 0 use default, active or passive scan */
+	int32 nprobes;			/* -1 use default, number of probes per channel */
+	int32 active_time;		/* -1 use default, dwell time per channel for
+					 * active scanning
+					 */
+	int32 passive_time;		/* -1 use default, dwell time per channel
+					 * for passive scanning
+					 */
+	int32 home_time;		/* -1 use default, dwell time for the home channel
+					 * between channel scans
+					 */
 } wl_join_scan_params_t;
 
-
+/* extended join params */
 typedef struct wl_extjoin_params {
-	wlc_ssid_t ssid;
+	wlc_ssid_t ssid;		/* {0, ""}: wildcard scan */
 	wl_join_scan_params_t scan;
-	wl_join_assoc_params_t assoc;
+	wl_join_assoc_params_t assoc;	/* optional field, but it must include the fixed portion
+					 * of the wl_join_assoc_params_t struct when it does
+					 * present.
+					 */
 } wl_extjoin_params_t;
 #define WL_EXTJOIN_PARAMS_FIXED_SIZE 	(OFFSETOF(wl_extjoin_params_t, assoc) + \
 					 WL_JOIN_ASSOC_PARAMS_FIXED_SIZE)
 
-
-
-#define NRATE_MCS_INUSE 0x00000080
-#define NRATE_RATE_MASK 0x0000007f
-#define NRATE_STF_MASK  0x0000ff00
-#define NRATE_STF_SHIFT 8
-#define NRATE_OVERRIDE  0x80000000
-#define NRATE_OVERRIDE_MCS_ONLY 0x40000000
-#define NRATE_SGI_MASK  0x00800000
-#define NRATE_SGI_SHIFT 23
-#define NRATE_LDPC_CODING 0x00400000
-#define NRATE_LDPC_SHIFT 22
-
-#define NRATE_STF_SISO  0
-#define NRATE_STF_CDD   1
-#define NRATE_STF_STBC  2
-#define NRATE_STF_SDM   3
-
-#define ANTENNA_NUM_1   1
-#define ANTENNA_NUM_2   2
-#define ANTENNA_NUM_3   3
-#define ANTENNA_NUM_4   4
-
-#define ANT_SELCFG_AUTO     0x80
-#define ANT_SELCFG_MASK     0x33
-#define ANT_SELCFG_MAX      4
-#define ANT_SELCFG_TX_UNICAST   0
-#define ANT_SELCFG_RX_UNICAST   1
-#define ANT_SELCFG_TX_DEF   2
-#define ANT_SELCFG_RX_DEF   3
-
-#define MAX_STREAMS_SUPPORTED   4
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+#ifndef D11AC_IOTYPES
+
+/* defines used by the nrate iovar */
+#define NRATE_MCS_INUSE	0x00000080	/* MSC in use,indicates b0-6 holds an mcs */
+#define NRATE_RATE_MASK 0x0000007f	/* rate/mcs value */
+#define NRATE_STF_MASK	0x0000ff00	/* stf mode mask: siso, cdd, stbc, sdm */
+#define NRATE_STF_SHIFT	8			/* stf mode shift */
+#define NRATE_OVERRIDE	0x80000000	/* bit indicates override both rate & mode */
+#define NRATE_OVERRIDE_MCS_ONLY 0x40000000 /* bit indicate to override mcs only */
+#define NRATE_SGI_MASK  0x00800000      /* sgi mode */
+#define NRATE_SGI_SHIFT 23              /* sgi mode */
+#define NRATE_LDPC_CODING 0x00400000    /* bit indicates adv coding in use */
+#define NRATE_LDPC_SHIFT 22             /* ldpc shift */
+
+#define NRATE_STF_SISO	0		/* stf mode SISO */
+#define NRATE_STF_CDD	1		/* stf mode CDD */
+#define NRATE_STF_STBC	2		/* stf mode STBC */
+#define NRATE_STF_SDM	3		/* stf mode SDM */
+
+#else /* D11AC_IOTYPES */
+
+/* WL_RSPEC defines for rate information */
+#define WL_RSPEC_RATE_MASK      0x000000FF      /* rate or HT MCS value */
+#define WL_RSPEC_VHT_MCS_MASK   0x0000000F      /* VHT MCS value */
+#define WL_RSPEC_VHT_NSS_MASK   0x000000F0      /* VHT Nss value */
+#define WL_RSPEC_VHT_NSS_SHIFT  4               /* VHT Nss value shift */
+#define WL_RSPEC_TXEXP_MASK     0x00000300
+#define WL_RSPEC_TXEXP_SHIFT    8
+#define WL_RSPEC_BW_MASK        0x00070000      /* bandwidth mask */
+#define WL_RSPEC_BW_SHIFT       16              /* bandwidth shift */
+#define WL_RSPEC_STBC           0x00100000      /* STBC encoding, Nsts = 2 x Nss */
+#define WL_RSPEC_TXBF           0x00200000      /* bit indicates TXBF mode */
+#define WL_RSPEC_LDPC           0x00400000      /* bit indicates adv coding in use */
+#define WL_RSPEC_SGI            0x00800000      /* Short GI mode */
+#define WL_RSPEC_ENCODING_MASK  0x03000000      /* Encoding of Rate/MCS field */
+#define WL_RSPEC_OVERRIDE_RATE  0x40000000      /* bit indicate to override mcs only */
+#define WL_RSPEC_OVERRIDE_MODE  0x80000000      /* bit indicates override both rate & mode */
+
+/* WL_RSPEC_ENCODING field defs */
+#define WL_RSPEC_ENCODE_RATE    0x00000000      /* Legacy rate is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_HT      0x01000000      /* HT MCS is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_VHT     0x02000000      /* VHT MCS and Nss is stored in RSPEC_RATE_MASK */
+
+/* WL_RSPEC_BW field defs */
+#define WL_RSPEC_BW_UNSPECIFIED 0
+#define WL_RSPEC_BW_20MHZ       0x00010000
+#define WL_RSPEC_BW_40MHZ       0x00020000
+#define WL_RSPEC_BW_80MHZ       0x00030000
+#define WL_RSPEC_BW_160MHZ      0x00040000
+
+/* Legacy defines for the nrate iovar */
+#define OLD_NRATE_MCS_INUSE         0x00000080 /* MSC in use,indicates b0-6 holds an mcs */
+#define OLD_NRATE_RATE_MASK         0x0000007f /* rate/mcs value */
+#define OLD_NRATE_STF_MASK          0x0000ff00 /* stf mode mask: siso, cdd, stbc, sdm */
+#define OLD_NRATE_STF_SHIFT         8          /* stf mode shift */
+#define OLD_NRATE_OVERRIDE          0x80000000 /* bit indicates override both rate & mode */
+#define OLD_NRATE_OVERRIDE_MCS_ONLY 0x40000000 /* bit indicate to override mcs only */
+#define OLD_NRATE_SGI               0x00800000 /* sgi mode */
+#define OLD_NRATE_LDPC_CODING       0x00400000 /* bit indicates adv coding in use */
+
+#define OLD_NRATE_STF_SISO	0		/* stf mode SISO */
+#define OLD_NRATE_STF_CDD	1		/* stf mode CDD */
+#define OLD_NRATE_STF_STBC	2		/* stf mode STBC */
+#define OLD_NRATE_STF_SDM	3		/* stf mode SDM */
+
+#endif /* D11AC_IOTYPES */
+
+#define ANTENNA_NUM_1	1		/* total number of antennas to be used */
+#define ANTENNA_NUM_2	2
+#define ANTENNA_NUM_3	3
+#define ANTENNA_NUM_4	4
+
+#define ANT_SELCFG_AUTO		0x80	/* bit indicates antenna sel AUTO */
+#define ANT_SELCFG_MASK		0x33	/* antenna configuration mask */
+#define ANT_SELCFG_MAX		4	/* max number of antenna configurations */
+#define ANT_SELCFG_TX_UNICAST	0	/* unicast tx antenna configuration */
+#define ANT_SELCFG_RX_UNICAST	1	/* unicast rx antenna configuration */
+#define ANT_SELCFG_TX_DEF	2	/* default tx antenna configuration */
+#define ANT_SELCFG_RX_DEF	3	/* default rx antenna configuration */
+
+#define MAX_STREAMS_SUPPORTED	4	/* max number of streams supported */
 
 typedef struct {
-	uint8 ant_config[ANT_SELCFG_MAX];
-	uint8 num_antcfg;
+	uint8 ant_config[ANT_SELCFG_MAX];	/* antenna configuration */
+	uint8 num_antcfg;	/* number of available antenna configurations */
 } wlc_antselcfg_t;
 
-#define HIGHEST_SINGLE_STREAM_MCS   7
+#define HIGHEST_SINGLE_STREAM_MCS	7 /* MCS values greater than this enable multiple streams */
 
-#define MAX_CCA_CHANNELS 38
-#define MAX_CCA_SECS     60
+#define MAX_CCA_CHANNELS 38	/* Max number of 20 Mhz wide channels */
+#define MAX_CCA_SECS     60	/* CCA keeps this many seconds history */
 
-#define IBSS_MED        15
-#define IBSS_HI         25
+#define IBSS_MED        15	/* Mediom in-bss congestion percentage */
+#define IBSS_HI         25	/* Hi in-bss congestion percentage */
 #define OBSS_MED        12
 #define OBSS_HI         25
 #define INTERFER_MED    5
 #define INTERFER_HI     10
 
-#define  CCA_FLAG_2G_ONLY       0x01
-#define  CCA_FLAG_5G_ONLY       0x02
-#define  CCA_FLAG_IGNORE_DURATION   0x04
-#define  CCA_FLAGS_PREFER_1_6_11    0x10
-#define  CCA_FLAG_IGNORE_INTERFER   0x20
+#define  CCA_FLAG_2G_ONLY		0x01	/* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_5G_ONLY		0x02	/* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_IGNORE_DURATION	0x04	/* Ignore dwell time for each channel */
+#define  CCA_FLAGS_PREFER_1_6_11	0x10
+#define  CCA_FLAG_IGNORE_INTERFER 	0x20 /* do not exlude channel based on interfer level */
 
-#define CCA_ERRNO_BAND      1
-#define CCA_ERRNO_DURATION  2
-#define CCA_ERRNO_PREF_CHAN 3
-#define CCA_ERRNO_INTERFER  4
-#define CCA_ERRNO_TOO_FEW   5
+#define CCA_ERRNO_BAND 		1	/* After filtering for band pref, no choices left */
+#define CCA_ERRNO_DURATION	2	/* After filtering for duration, no choices left */
+#define CCA_ERRNO_PREF_CHAN	3	/* After filtering for chan pref, no choices left */
+#define CCA_ERRNO_INTERFER	4	/* After filtering for interference, no choices left */
+#define CCA_ERRNO_TOO_FEW	5	/* Only 1 channel was input */
 
 typedef struct {
-	uint32 duration;
-	uint32 congest_ibss;
-
-	uint32 congest_obss;
-	uint32 interference;
-	uint32 timestamp;
+	uint32 duration;	/* millisecs spent sampling this channel */
+	uint32 congest_ibss;	/* millisecs in our bss (presumably this traffic will */
+				/*  move if cur bss moves channels) */
+	uint32 congest_obss;	/* traffic not in our bss */
+	uint32 interference;	/* millisecs detecting a non 802.11 interferer. */
+	uint32 timestamp;	/* second timestamp */
 } cca_congest_t;
 
 typedef struct {
-	chanspec_t chanspec;
-	uint8 num_secs;
-	cca_congest_t  secs[1];
+	chanspec_t chanspec;	/* Which channel? */
+	uint8 num_secs;		/* How many secs worth of data */
+	cca_congest_t  secs[1];	/* Data */
 } cca_congest_channel_req_t;
 
+/* interference source detection and identification mode */
 #define ITFR_MODE_DISABLE	0	/* disable feature */
 #define ITFR_MODE_MANUAL_ENABLE	1	/* enable manual detection */
 #define ITFR_MODE_AUTO_ENABLE	2	/* enable auto detection */
@@ -600,12 +724,26 @@ typedef struct {
 #define ITFR_INTERFERENCED	1	/* interference detected */
 #define ITFR_HOME_CHANNEL	2	/* home channel has interference */
 #define ITFR_NOISY_ENVIRONMENT	4	/* noisy environemnt so feature stopped */
-#define WLC_CNTRY_BUF_SZ    4
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define WLC_CNTRY_BUF_SZ	4		/* Country string is 3 bytes + NUL */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 
 typedef struct wl_country {
-	char country_abbrev[WLC_CNTRY_BUF_SZ];
-	int32 rev;
-	char ccode[WLC_CNTRY_BUF_SZ];
+	char country_abbrev[WLC_CNTRY_BUF_SZ];	/* nul-terminated country code used in
+						 * the Country IE
+						 */
+	int32 rev;				/* revision specifier for ccode
+						 * on set, -1 indicates unspecified.
+						 * on get, rev >= 0
+						 */
+	char ccode[WLC_CNTRY_BUF_SZ];		/* nul-terminated built-in country code.
+						 * variable length, but fixed size in
+						 * struct allows simple allocation for
+						 * expected country strings <= 3 chars.
+						 */
 } wl_country_t;
 
 typedef struct wl_channels_in_country {
@@ -624,65 +762,65 @@ typedef struct wl_country_list {
 	char country_abbrev[1];
 } wl_country_list_t;
 
-#define WL_NUM_RPI_BINS     8
-#define WL_RM_TYPE_BASIC    1
-#define WL_RM_TYPE_CCA      2
-#define WL_RM_TYPE_RPI      3
+#define WL_NUM_RPI_BINS		8
+#define WL_RM_TYPE_BASIC	1
+#define WL_RM_TYPE_CCA		2
+#define WL_RM_TYPE_RPI		3
 
-#define WL_RM_FLAG_PARALLEL (1<<0)
+#define WL_RM_FLAG_PARALLEL	(1<<0)
 
-#define WL_RM_FLAG_LATE     (1<<1)
-#define WL_RM_FLAG_INCAPABLE    (1<<2)
-#define WL_RM_FLAG_REFUSED  (1<<3)
+#define WL_RM_FLAG_LATE		(1<<1)
+#define WL_RM_FLAG_INCAPABLE	(1<<2)
+#define WL_RM_FLAG_REFUSED	(1<<3)
 
 typedef struct wl_rm_req_elt {
-	int8    type;
-	int8    flags;
-	chanspec_t  chanspec;
-	uint32  token;
-	uint32  tsf_h;
-	uint32  tsf_l;
-	uint32  dur;
+	int8	type;
+	int8	flags;
+	chanspec_t	chanspec;
+	uint32	token;		/* token for this measurement */
+	uint32	tsf_h;		/* TSF high 32-bits of Measurement start time */
+	uint32	tsf_l;		/* TSF low 32-bits */
+	uint32	dur;		/* TUs */
 } wl_rm_req_elt_t;
 
 typedef struct wl_rm_req {
-	uint32  token;
-	uint32  count;
-	void    *cb;
-	void    *cb_arg;
-	wl_rm_req_elt_t req[1];
+	uint32	token;		/* overall measurement set token */
+	uint32	count;		/* number of measurement requests */
+	void	*cb;		/* completion callback function: may be NULL */
+	void	*cb_arg;	/* arg to completion callback function */
+	wl_rm_req_elt_t	req[1];	/* variable length block of requests */
 } wl_rm_req_t;
-#define WL_RM_REQ_FIXED_LEN OFFSETOF(wl_rm_req_t, req)
+#define WL_RM_REQ_FIXED_LEN	OFFSETOF(wl_rm_req_t, req)
 
 typedef struct wl_rm_rep_elt {
-	int8    type;
-	int8    flags;
-	chanspec_t  chanspec;
-	uint32  token;
-	uint32  tsf_h;
-	uint32  tsf_l;
-	uint32  dur;
-	uint32  len;
-	uint8   data[1];
+	int8	type;
+	int8	flags;
+	chanspec_t	chanspec;
+	uint32	token;		/* token for this measurement */
+	uint32	tsf_h;		/* TSF high 32-bits of Measurement start time */
+	uint32	tsf_l;		/* TSF low 32-bits */
+	uint32	dur;		/* TUs */
+	uint32	len;		/* byte length of data block */
+	uint8	data[1];	/* variable length data block */
 } wl_rm_rep_elt_t;
-#define WL_RM_REP_ELT_FIXED_LEN 24
+#define WL_RM_REP_ELT_FIXED_LEN	24	/* length excluding data block */
 
 #define WL_RPI_REP_BIN_NUM 8
 typedef struct wl_rm_rpi_rep {
-	uint8   rpi[WL_RPI_REP_BIN_NUM];
-	int8    rpi_max[WL_RPI_REP_BIN_NUM];
+	uint8	rpi[WL_RPI_REP_BIN_NUM];
+	int8	rpi_max[WL_RPI_REP_BIN_NUM];
 } wl_rm_rpi_rep_t;
 
 typedef struct wl_rm_rep {
-	uint32  token;
-	uint32  len;
-	wl_rm_rep_elt_t rep[1];
+	uint32	token;		/* overall measurement set token */
+	uint32	len;		/* length of measurement report block */
+	wl_rm_rep_elt_t	rep[1];	/* variable length block of reports */
 } wl_rm_rep_t;
-#define WL_RM_REP_FIXED_LEN 8
+#define WL_RM_REP_FIXED_LEN	8
 
 
 typedef enum sup_auth_status {
-
+	/* Basic supplicant authentication states */
 	WLC_SUP_DISCONNECTED = 0,
 	WLC_SUP_CONNECTING,
 	WLC_SUP_IDREQUIRED,
@@ -693,119 +831,151 @@ typedef enum sup_auth_status {
 	WLC_SUP_TIMEOUT,
 	WLC_SUP_LAST_BASIC_STATE,
 
-
-
+	/* Extended supplicant authentication states */
+	/* Waiting to receive handshake msg M1 */
 	WLC_SUP_KEYXCHANGE_WAIT_M1 = WLC_SUP_AUTHENTICATED,
-
+	/* Preparing to send handshake msg M2 */
 	WLC_SUP_KEYXCHANGE_PREP_M2 = WLC_SUP_KEYXCHANGE,
-
+	/* Waiting to receive handshake msg M3 */
 	WLC_SUP_KEYXCHANGE_WAIT_M3 = WLC_SUP_LAST_BASIC_STATE,
-	WLC_SUP_KEYXCHANGE_PREP_M4,
-	WLC_SUP_KEYXCHANGE_WAIT_G1,
-	WLC_SUP_KEYXCHANGE_PREP_G2
+	WLC_SUP_KEYXCHANGE_PREP_M4,	/* Preparing to send handshake msg M4 */
+	WLC_SUP_KEYXCHANGE_WAIT_G1,	/* Waiting to receive handshake msg G1 */
+	WLC_SUP_KEYXCHANGE_PREP_G2	/* Preparing to send handshake msg G2 */
 } sup_auth_status_t;
-
-
-#define CRYPTO_ALGO_OFF         0
-#define CRYPTO_ALGO_WEP1        1
-#define CRYPTO_ALGO_TKIP        2
-#define CRYPTO_ALGO_WEP128      3
-#define CRYPTO_ALGO_AES_CCM     4
-#define CRYPTO_ALGO_AES_OCB_MSDU    5
-#define CRYPTO_ALGO_AES_OCB_MPDU    6
-#define CRYPTO_ALGO_NALG        7
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* Enumerate crypto algorithms */
+#define	CRYPTO_ALGO_OFF			0
+#define	CRYPTO_ALGO_WEP1		1
+#define	CRYPTO_ALGO_TKIP		2
+#define	CRYPTO_ALGO_WEP128		3
+#define CRYPTO_ALGO_AES_CCM		4
+#define CRYPTO_ALGO_AES_OCB_MSDU	5
+#define CRYPTO_ALGO_AES_OCB_MPDU	6
+#if !defined(BCMEXTCCX)
+#define CRYPTO_ALGO_NALG		7
+#else
+#define CRYPTO_ALGO_CKIP		7
+#define CRYPTO_ALGO_CKIP_MMH		8
+#define CRYPTO_ALGO_WEP_MMH		9
+#define CRYPTO_ALGO_NALG		10
+#endif 
 #define CRYPTO_ALGO_PMK			12	/* for 802.1x supp to set PMK before 4-way */
+#define CRYPTO_ALGO_BIP			13  /* 802.11w BIP (aes cmac) */
 
-#define WSEC_GEN_MIC_ERROR  0x0001
-#define WSEC_GEN_REPLAY     0x0002
-#define WSEC_GEN_ICV_ERROR  0x0004
+#define WSEC_GEN_MIC_ERROR	0x0001
+#define WSEC_GEN_REPLAY		0x0002
+#define WSEC_GEN_ICV_ERROR	0x0004
 #define WSEC_GEN_MFP_ACT_ERROR	0x0008
 #define WSEC_GEN_MFP_DISASSOC_ERROR	0x0010
 #define WSEC_GEN_MFP_DEAUTH_ERROR	0x0020
 
-#define WL_SOFT_KEY (1 << 0)
-#define WL_PRIMARY_KEY  (1 << 1)
-#define WL_KF_RES_4 (1 << 4)
-#define WL_KF_RES_5 (1 << 5)
-#define WL_IBSS_PEER_GROUP_KEY  (1 << 6)
+#define WL_SOFT_KEY	(1 << 0)	/* Indicates this key is using soft encrypt */
+#define WL_PRIMARY_KEY	(1 << 1)	/* Indicates this key is the primary (ie tx) key */
+#if defined(BCMEXTCCX)
+#define WL_CKIP_KP	(1 << 4)	/* CMIC */
+#define WL_CKIP_MMH	(1 << 5)	/* CKIP */
+#else
+#define WL_KF_RES_4	(1 << 4)	/* Reserved for backward compat */
+#define WL_KF_RES_5	(1 << 5)	/* Reserved for backward compat */
+#endif 
+#define WL_IBSS_PEER_GROUP_KEY	(1 << 6)	/* Indicates a group key for a IBSS PEER */
 
 typedef struct wl_wsec_key {
-	uint32      index;
-	uint32      len;
-	uint8       data[DOT11_MAX_KEY_SIZE];
-	uint32      pad_1[18];
-	uint32      algo;
-	uint32      flags;
-	uint32      pad_2[2];
-	int     pad_3;
-	int     iv_initialized;
-	int     pad_4;
-
+	uint32		index;		/* key index */
+	uint32		len;		/* key length */
+	uint8		data[DOT11_MAX_KEY_SIZE];	/* key data */
+	uint32		pad_1[18];
+	uint32		algo;		/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+	uint32		flags;		/* misc flags */
+	uint32		pad_2[2];
+	int		pad_3;
+	int		iv_initialized;	/* has IV been initialized already? */
+	int		pad_4;
+	/* Rx IV */
 	struct {
-		uint32  hi;
-		uint16  lo;
+		uint32	hi;		/* upper 32 bits of IV */
+		uint16	lo;		/* lower 16 bits of IV */
 	} rxiv;
-	uint32      pad_5[2];
-	struct ether_addr ea;
+	uint32		pad_5[2];
+	struct ether_addr ea;		/* per station */
 } wl_wsec_key_t;
 
-#define WSEC_MIN_PSK_LEN    8
-#define WSEC_MAX_PSK_LEN    64
-
-
-#define WSEC_PASSPHRASE     (1<<0)
+#define WSEC_MIN_PSK_LEN	8
+#define WSEC_MAX_PSK_LEN	64
 
+/* Flag for key material needing passhash'ing */
+#define WSEC_PASSPHRASE		(1<<0)
 
+/* receptacle for WLC_SET_WSEC_PMK parameter */
 typedef struct {
-	ushort  key_len;
-	ushort  flags;
-	uint8   key[WSEC_MAX_PSK_LEN];
+	ushort	key_len;		/* octets in key material */
+	ushort	flags;			/* key handling qualification */
+	uint8	key[WSEC_MAX_PSK_LEN];	/* PMK material */
 } wsec_pmk_t;
 
+/* wireless security bitvec */
+#define WEP_ENABLED		0x0001
+#define TKIP_ENABLED		0x0002
+#define AES_ENABLED		0x0004
+#define WSEC_SWFLAG		0x0008
+#define SES_OW_ENABLED		0x0040	/* to go into transition mode without setting wep */
 
-#define WEP_ENABLED     0x0001
-#define TKIP_ENABLED        0x0002
-#define AES_ENABLED     0x0004
-#define WSEC_SWFLAG     0x0008
-#define SES_OW_ENABLED      0x0040
-
+/* wsec macros for operating on the above definitions */
 #define WSEC_WEP_ENABLED(wsec)	((wsec) & WEP_ENABLED)
 #define WSEC_TKIP_ENABLED(wsec)	((wsec) & TKIP_ENABLED)
 #define WSEC_AES_ENABLED(wsec)	((wsec) & AES_ENABLED)
 
-#define WPA_AUTH_DISABLED   0x0000
-#define WPA_AUTH_NONE       0x0001
-#define WPA_AUTH_UNSPECIFIED    0x0002
-#define WPA_AUTH_PSK        0x0004
-
-#define WPA2_AUTH_UNSPECIFIED   0x0040
-#define WPA2_AUTH_PSK       0x0080
-#define BRCM_AUTH_PSK           0x0100
-#define BRCM_AUTH_DPT       0x0200
-
-
-#define MAXPMKID        16
+#define WSEC_ENABLED(wsec)	((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+#define WSEC_SES_OW_ENABLED(wsec)	((wsec) & SES_OW_ENABLED)
+
+#define MFP_CAPABLE		0x0200
+#define MFP_REQUIRED	0x0400
+#define MFP_SHA256		0x0800 /* a special configuration for STA for WIFI test tool */
+
+/* WPA authentication mode bitvec */
+#define WPA_AUTH_DISABLED	0x0000	/* Legacy (i.e., non-WPA) */
+#define WPA_AUTH_NONE		0x0001	/* none (IBSS) */
+#define WPA_AUTH_UNSPECIFIED	0x0002	/* over 802.1x */
+#define WPA_AUTH_PSK		0x0004	/* Pre-shared key */
+#if defined(BCMEXTCCX)
+#define WPA_AUTH_CCKM		0x0008	/* CCKM */
+#define WPA2_AUTH_CCKM		0x0010	/* CCKM2 */
+#endif	
+/* #define WPA_AUTH_8021X 0x0020 */	/* 802.1x, reserved */
+#define WPA2_AUTH_UNSPECIFIED	0x0040	/* over 802.1x */
+#define WPA2_AUTH_PSK		0x0080	/* Pre-shared key */
+#define BRCM_AUTH_PSK           0x0100  /* BRCM specific PSK */
+#define BRCM_AUTH_DPT		0x0200	/* DPT PSK without group keys */
+#define WPA2_AUTH_MFP           0x1000  /* MFP (11w) in contrast to CCX */
+#define WPA2_AUTH_TPK		0x2000 	/* TDLS Peer Key */
+#define WPA2_AUTH_FT		0x4000 	/* Fast Transition. */
+#define WPA_AUTH_PFN_ANY	0xffffffff	/* for PFN, match only ssid */
+
+/* pmkid */
+#define	MAXPMKID		16
 
 typedef struct _pmkid {
-	struct ether_addr   BSSID;
-	uint8           PMKID[WPA2_PMKID_LEN];
+	struct ether_addr	BSSID;
+	uint8			PMKID[WPA2_PMKID_LEN];
 } pmkid_t;
 
 typedef struct _pmkid_list {
-	uint32  npmkid;
-	pmkid_t pmkid[1];
+	uint32	npmkid;
+	pmkid_t	pmkid[1];
 } pmkid_list_t;
 
 typedef struct _pmkid_cand {
-	struct ether_addr   BSSID;
-	uint8           preauth;
+	struct ether_addr	BSSID;
+	uint8			preauth;
 } pmkid_cand_t;
 
 typedef struct _pmkid_cand_list {
-	uint32  npmkid_cand;
-	pmkid_cand_t    pmkid_cand[1];
+	uint32	npmkid_cand;
+	pmkid_cand_t	pmkid_cand[1];
 } pmkid_cand_list_t;
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 typedef struct wl_assoc_info {
 	uint32		req_len;
 	uint32		resp_len;
@@ -880,6 +1050,32 @@ typedef struct wme_tx_params_s wme_tx_params_t;
 
 #define WL_WME_TX_PARAMS_IO_BYTES (sizeof(wme_tx_params_t) * AC_COUNT)
 
+typedef struct wl_plc_nodelist {
+	uint count;			/* Number of nodes */
+	struct _node {
+		struct ether_addr ea;	/* Node ether address */
+		uint32 node_type;	/* Node type */
+		uint32 cost;		/* PLC affinity */
+	} node[1];
+} wl_plc_nodelist_t;
+
+typedef struct wl_plc_params {
+	uint32	cmd;			/* Command */
+	bool	plc_failover;		/* PLC failover control/status */
+	struct	ether_addr node_ea;	/* Node ether address */
+	uint32	cost;			/* Link cost or mac cost */
+} wl_plc_params_t;
+
+#define	PLC_CMD_FAILOVER	1
+#define	PLC_CMD_MAC_COST	2
+#define	PLC_CMD_LINK_COST	3
+#define	PLC_CMD_NODE_LIST	4
+
+#define NODE_TYPE_UNKNOWN	0	/* Unknown link */
+#define NODE_TYPE_WIFI_ONLY	1	/* Pure Wireless STA node */
+#define NODE_TYPE_PLC_ONLY	2	/* Pure PLC only node */
+#define NODE_TYPE_WIFI_PLC	3	/* WiFi PLC capable node */
+
 /* defines used by poweridx iovar - it controls power in a-band */
 /* current gain setting is maintained */
 #define WL_PWRIDX_PCL_OFF	-2	/* turn off PCL.  */
@@ -947,40 +1143,94 @@ typedef struct {
 #define WLC_TXFILTER_OVERRIDE_DISABLED  0
 #define WLC_TXFILTER_OVERRIDE_ENABLED   1
 
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
+/* Used to get specific STA parameters */
 typedef struct {
-	uint32  val;
+	uint32	val;
 	struct ether_addr ea;
 } scb_val_t;
 
-
+/* Used by iovar versions of some ioctls, i.e. WLC_SCB_AUTHORIZE et al */
 typedef struct {
 	uint32 code;
 	scb_val_t ioctl_args;
 } authops_t;
 
-
+/* channel encoding */
 typedef struct channel_info {
 	int hw_channel;
 	int target_channel;
 	int scan_channel;
 } channel_info_t;
 
-
+/* For ioctls that take a list of MAC addresses */
 struct maclist {
-	uint count;
-	struct ether_addr ea[1];
+	uint count;			/* number of MAC addresses */
+	struct ether_addr ea[1];	/* variable length array of MAC addresses */
 };
 
-
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* get pkt count struct passed through ioctl */
 typedef struct get_pktcnt {
 	uint rx_good_pkt;
 	uint rx_bad_pkt;
 	uint tx_good_pkt;
 	uint tx_bad_pkt;
-	uint rx_ocast_good_pkt;
+	uint rx_ocast_good_pkt; /* unicast packets destined for others */
 } get_pktcnt_t;
 
+/* NINTENDO2 */
+#define LQ_IDX_MIN              0
+#define LQ_IDX_MAX              1
+#define LQ_IDX_AVG              2
+#define LQ_IDX_SUM              2
+#define LQ_IDX_LAST             3
+#define LQ_STOP_MONITOR         0
+#define LQ_START_MONITOR        1
+
+/* Get averages RSSI, Rx PHY rate and SNR values */
+typedef struct {
+	int rssi[LQ_IDX_LAST];  /* Array to keep min, max, avg rssi */
+	int snr[LQ_IDX_LAST];   /* Array to keep min, max, avg snr */
+	int isvalid;            /* Flag indicating whether above data is valid */
+} wl_lq_t; /* Link Quality */
+
+typedef enum wl_wakeup_reason_type {
+	LCD_ON = 1,
+	LCD_OFF,
+	DRC1_WAKE,
+	DRC2_WAKE,
+	REASON_LAST
+} wl_wr_type_t;
+
+typedef struct {
+/* Unique filter id */
+	uint32	id;
+
+/* stores the reason for the last wake up */
+	uint8	reason;
+} wl_wr_t;
+
+/* Get MAC specific rate histogram command */
+typedef struct {
+	struct	ether_addr ea;	/* MAC Address */
+	uint8	ac_cat;	/* Access Category */
+	uint8	num_pkts;	/* Number of packet entries to be averaged */
+} wl_mac_ratehisto_cmd_t;	/* MAC Specific Rate Histogram command */
+
+/* Get MAC rate histogram response */
+typedef struct {
+	uint32	rate[DOT11_RATE_MAX + 1];	/* Rates */
+	uint32	mcs[WL_RATESET_SZ_HT_MCS * WL_TX_CHAINS_MAX];	/* MCS counts */
+	uint32	vht[WL_RATESET_SZ_VHT_MCS][WL_TX_CHAINS_MAX];	/* VHT counts */
+	uint32	tsf_timer[2][2];	/* Start and End time for 8bytes value */
+} wl_mac_ratehisto_res_t;	/* MAC Specific Rate Histogram Response */
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
 #define WL_IOCTL_ACTION_GET				0x0
 #define WL_IOCTL_ACTION_SET				0x1
 #define WL_IOCTL_ACTION_OVL_IDX_MASK	0x1e
@@ -989,42 +1239,50 @@ typedef struct get_pktcnt {
 #define WL_IOCTL_ACTION_MASK			0x7e
 #define WL_IOCTL_ACTION_OVL_SHIFT		1
 
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
+/* Linux network driver ioctl encoding */
 typedef struct wl_ioctl {
-	uint cmd;
-	void *buf;
-	uint len;
-	uint8 set;
-	uint used;
-	uint needed;
+	uint cmd;	/* common ioctl definition */
+	void *buf;	/* pointer to user buffer */
+	uint len;	/* length of user buffer */
+	uint8 set;		/* 1=set IOCTL; 0=query IOCTL */
+	uint used;	/* bytes read or written (optional) */
+	uint needed;	/* bytes needed (optional) */
 } wl_ioctl_t;
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 
-#define ioctl_subtype   set
-#define ioctl_pid   used
-#define ioctl_status    needed
-
+/* reference to wl_ioctl_t struct used by usermode driver */
+#define ioctl_subtype	set		/* subtype param */
+#define ioctl_pid	used		/* pid param */
+#define ioctl_status	needed		/* status param */
 
+/*
+ * Structure for passing hardware and software
+ * revision info up from the driver.
+ */
 typedef struct wlc_rev_info {
-	uint        vendorid;
-	uint        deviceid;
-	uint        radiorev;
-	uint        chiprev;
-	uint        corerev;
-	uint        boardid;
-	uint        boardvendor;
-	uint        boardrev;
-	uint        driverrev;
-	uint        ucoderev;
-	uint        bus;
-	uint        chipnum;
-	uint        phytype;
-	uint        phyrev;
-	uint        anarev;
-	uint        chippkg;
+	uint		vendorid;	/* PCI vendor id */
+	uint		deviceid;	/* device id of chip */
+	uint		radiorev;	/* radio revision */
+	uint		chiprev;	/* chip revision */
+	uint		corerev;	/* core revision */
+	uint		boardid;	/* board identifier (usu. PCI sub-device id) */
+	uint		boardvendor;	/* board vendor (usu. PCI sub-vendor id) */
+	uint		boardrev;	/* board revision */
+	uint		driverrev;	/* driver version */
+	uint		ucoderev;	/* microcode version */
+	uint		bus;		/* bus type */
+	uint		chipnum;	/* chip number */
+	uint		phytype;	/* phy type */
+	uint		phyrev;		/* phy revision */
+	uint		anarev;		/* anacore rev */
+	uint		chippkg;	/* chip package info */
+	uint		nvramrev;	/* nvram revision number */
 } wlc_rev_info_t;
 
-#define WL_REV_INFO_LEGACY_LENGTH   48
+#define WL_REV_INFO_LEGACY_LENGTH	48
 
 #define WL_BRAND_MAX 10
 typedef struct wl_instance_info {
@@ -1032,17 +1290,17 @@ typedef struct wl_instance_info {
 	char brand[WL_BRAND_MAX];
 } wl_instance_info_t;
 
-
+/* structure to change size of tx fifo */
 typedef struct wl_txfifo_sz {
-	uint16  magic;
-	uint16  fifo;
-	uint16  size;
+	uint16	magic;
+	uint16	fifo;
+	uint16	size;
 } wl_txfifo_sz_t;
+/* magic pattern used for mismatch driver and wl */
+#define WL_TXFIFO_SZ_MAGIC	0xa5a5
 
-#define WL_TXFIFO_SZ_MAGIC  0xa5a5
-
-
-
+/* Transfer info about an IOVar from the driver */
+/* Max supported IOV name size in bytes, + 1 for nul termination */
 #define WLC_IOV_NAME_LEN 30
 typedef struct wlc_iov_trx_s {
 	uint8 module;
@@ -1050,395 +1308,425 @@ typedef struct wlc_iov_trx_s {
 	char name[WLC_IOV_NAME_LEN];
 } wlc_iov_trx_t;
 
+/* check this magic number */
+#define WLC_IOCTL_MAGIC		0x14e46c77
 
-#define WLC_IOCTL_MAGIC     0x14e46c77
-
-
-#define WLC_IOCTL_VERSION   1
-
-#define WLC_IOCTL_MAXLEN        8192
-#define WLC_IOCTL_SMLEN         256
-#define WLC_IOCTL_MEDLEN        1536
-#ifdef WLC_HIGH_ONLY
-#define WLC_SAMPLECOLLECT_MAXLEN    1024
+/* bump this number if you change the ioctl interface */
+#ifdef D11AC_IOTYPES
+#define WLC_IOCTL_VERSION	2
+#define WLC_IOCTL_VERSION_LEGACY_IOTYPES	1
+#else
+#define WLC_IOCTL_VERSION	1
+#endif /* D11AC_IOTYPES */
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define	WLC_IOCTL_MAXLEN		8192	/* max length ioctl buffer required */
+#define	WLC_IOCTL_SMLEN			256	/* "small" length ioctl buffer required */
+#define WLC_IOCTL_MEDLEN		1536    /* "med" length ioctl buffer required */
+#if defined(LCNCONF) || defined(LCN40CONF)
+#define WLC_SAMPLECOLLECT_MAXLEN	8192	/* Max Sample Collect buffer */
 #else
-#define WLC_SAMPLECOLLECT_MAXLEN    10240
+#define WLC_SAMPLECOLLECT_MAXLEN	10240	/* Max Sample Collect buffer for two cores */
 #endif
 
-
-#define WLC_GET_MAGIC               0
-#define WLC_GET_VERSION             1
-#define WLC_UP                  2
-#define WLC_DOWN                3
-#define WLC_GET_LOOP                4
-#define WLC_SET_LOOP                5
-#define WLC_DUMP                6
-#define WLC_GET_MSGLEVEL            7
-#define WLC_SET_MSGLEVEL            8
-#define WLC_GET_PROMISC             9
-#define WLC_SET_PROMISC             10
+/* common ioctl definitions */
+#define WLC_GET_MAGIC				0
+#define WLC_GET_VERSION				1
+#define WLC_UP					2
+#define WLC_DOWN				3
+#define WLC_GET_LOOP				4
+#define WLC_SET_LOOP				5
+#define WLC_DUMP				6
+#define WLC_GET_MSGLEVEL			7
+#define WLC_SET_MSGLEVEL			8
+#define WLC_GET_PROMISC				9
+#define WLC_SET_PROMISC				10
 /* #define WLC_OVERLAY_IOCTL			11 */ /* not supported */
-#define WLC_GET_RATE                12
+#define WLC_GET_RATE				12
 #define WLC_GET_MAX_RATE			13
-#define WLC_GET_INSTANCE            14
-
-
-
-
-#define WLC_GET_INFRA               19
-#define WLC_SET_INFRA               20
-#define WLC_GET_AUTH                21
-#define WLC_SET_AUTH                22
-#define WLC_GET_BSSID               23
-#define WLC_SET_BSSID               24
-#define WLC_GET_SSID                25
-#define WLC_SET_SSID                26
-#define WLC_RESTART             27
+#define WLC_GET_INSTANCE			14
+/* #define WLC_GET_FRAG				15 */ /* no longer supported */
+/* #define WLC_SET_FRAG				16 */ /* no longer supported */
+/* #define WLC_GET_RTS				17 */ /* no longer supported */
+/* #define WLC_SET_RTS				18 */ /* no longer supported */
+#define WLC_GET_INFRA				19
+#define WLC_SET_INFRA				20
+#define WLC_GET_AUTH				21
+#define WLC_SET_AUTH				22
+#define WLC_GET_BSSID				23
+#define WLC_SET_BSSID				24
+#define WLC_GET_SSID				25
+#define WLC_SET_SSID				26
+#define WLC_RESTART				27
 #define WLC_TERMINATED             		28
-#define WLC_GET_CHANNEL             29
-#define WLC_SET_CHANNEL             30
-#define WLC_GET_SRL             31
-#define WLC_SET_SRL             32
-#define WLC_GET_LRL             33
-#define WLC_SET_LRL             34
-#define WLC_GET_PLCPHDR             35
-#define WLC_SET_PLCPHDR             36
-#define WLC_GET_RADIO               37
-#define WLC_SET_RADIO               38
-#define WLC_GET_PHYTYPE             39
-#define WLC_DUMP_RATE               40
-#define WLC_SET_RATE_PARAMS         41
-#define WLC_GET_FIXRATE             42
-#define WLC_SET_FIXRATE             43
-
-
-#define WLC_GET_KEY             44
-#define WLC_SET_KEY             45
-#define WLC_GET_REGULATORY          46
-#define WLC_SET_REGULATORY          47
-#define WLC_GET_PASSIVE_SCAN            48
-#define WLC_SET_PASSIVE_SCAN            49
-#define WLC_SCAN                50
-#define WLC_SCAN_RESULTS            51
-#define WLC_DISASSOC                52
-#define WLC_REASSOC             53
-#define WLC_GET_ROAM_TRIGGER            54
-#define WLC_SET_ROAM_TRIGGER            55
-#define WLC_GET_ROAM_DELTA          56
-#define WLC_SET_ROAM_DELTA          57
-#define WLC_GET_ROAM_SCAN_PERIOD        58
-#define WLC_SET_ROAM_SCAN_PERIOD        59
-#define WLC_EVM                 60
-#define WLC_GET_TXANT               61
-#define WLC_SET_TXANT               62
-#define WLC_GET_ANTDIV              63
-#define WLC_SET_ANTDIV              64
-
-
-#define WLC_GET_CLOSED              67
-#define WLC_SET_CLOSED              68
-#define WLC_GET_MACLIST             69
-#define WLC_SET_MACLIST             70
-#define WLC_GET_RATESET             71
-#define WLC_SET_RATESET             72
-
-#define WLC_LONGTRAIN               74
-#define WLC_GET_BCNPRD              75
-#define WLC_SET_BCNPRD              76
-#define WLC_GET_DTIMPRD             77
-#define WLC_SET_DTIMPRD             78
-#define WLC_GET_SROM                79
-#define WLC_SET_SROM                80
-#define WLC_GET_WEP_RESTRICT            81
-#define WLC_SET_WEP_RESTRICT            82
-#define WLC_GET_COUNTRY             83
-#define WLC_SET_COUNTRY             84
-#define WLC_GET_PM              85
-#define WLC_SET_PM              86
-#define WLC_GET_WAKE                87
-#define WLC_SET_WAKE                88
-
-#define WLC_GET_FORCELINK           90
-#define WLC_SET_FORCELINK           91
-#define WLC_FREQ_ACCURACY           92
-#define WLC_CARRIER_SUPPRESS            93
-#define WLC_GET_PHYREG              94
-#define WLC_SET_PHYREG              95
-#define WLC_GET_RADIOREG            96
-#define WLC_SET_RADIOREG            97
-#define WLC_GET_REVINFO             98
-#define WLC_GET_UCANTDIV            99
-#define WLC_SET_UCANTDIV            100
-#define WLC_R_REG               101
-#define WLC_W_REG               102
-
-
-#define WLC_GET_MACMODE             105
-#define WLC_SET_MACMODE             106
-#define WLC_GET_MONITOR             107
-#define WLC_SET_MONITOR             108
-#define WLC_GET_GMODE               109
-#define WLC_SET_GMODE               110
-#define WLC_GET_LEGACY_ERP          111
-#define WLC_SET_LEGACY_ERP          112
-#define WLC_GET_RX_ANT              113
-#define WLC_GET_CURR_RATESET            114
-#define WLC_GET_SCANSUPPRESS            115
-#define WLC_SET_SCANSUPPRESS            116
-#define WLC_GET_AP              117
-#define WLC_SET_AP              118
-#define WLC_GET_EAP_RESTRICT            119
-#define WLC_SET_EAP_RESTRICT            120
-#define WLC_SCB_AUTHORIZE           121
-#define WLC_SCB_DEAUTHORIZE         122
-#define WLC_GET_WDSLIST             123
-#define WLC_SET_WDSLIST             124
-#define WLC_GET_ATIM                125
-#define WLC_SET_ATIM                126
-#define WLC_GET_RSSI                127
-#define WLC_GET_PHYANTDIV           128
-#define WLC_SET_PHYANTDIV           129
-#define WLC_AP_RX_ONLY              130
-#define WLC_GET_TX_PATH_PWR         131
-#define WLC_SET_TX_PATH_PWR         132
-#define WLC_GET_WSEC                133
-#define WLC_SET_WSEC                134
-#define WLC_GET_PHY_NOISE           135
-#define WLC_GET_BSS_INFO            136
-#define WLC_GET_PKTCNTS             137
-#define WLC_GET_LAZYWDS             138
-#define WLC_SET_LAZYWDS             139
-#define WLC_GET_BANDLIST            140
-#define WLC_GET_BAND                141
-#define WLC_SET_BAND                142
-#define WLC_SCB_DEAUTHENTICATE          143
-#define WLC_GET_SHORTSLOT           144
-#define WLC_GET_SHORTSLOT_OVERRIDE      145
-#define WLC_SET_SHORTSLOT_OVERRIDE      146
-#define WLC_GET_SHORTSLOT_RESTRICT      147
-#define WLC_SET_SHORTSLOT_RESTRICT      148
-#define WLC_GET_GMODE_PROTECTION        149
-#define WLC_GET_GMODE_PROTECTION_OVERRIDE   150
-#define WLC_SET_GMODE_PROTECTION_OVERRIDE   151
-#define WLC_UPGRADE             152
-
-
-#define WLC_GET_IGNORE_BCNS         155
-#define WLC_SET_IGNORE_BCNS         156
-#define WLC_GET_SCB_TIMEOUT         157
-#define WLC_SET_SCB_TIMEOUT         158
-#define WLC_GET_ASSOCLIST           159
-#define WLC_GET_CLK             160
-#define WLC_SET_CLK             161
-#define WLC_GET_UP              162
-#define WLC_OUT                 163
-#define WLC_GET_WPA_AUTH            164
-#define WLC_SET_WPA_AUTH            165
-#define WLC_GET_UCFLAGS             166
-#define WLC_SET_UCFLAGS             167
-#define WLC_GET_PWRIDX              168
-#define WLC_SET_PWRIDX              169
-#define WLC_GET_TSSI                170
-#define WLC_GET_SUP_RATESET_OVERRIDE        171
-#define WLC_SET_SUP_RATESET_OVERRIDE        172
-
-
-
-
-
-#define WLC_GET_PROTECTION_CONTROL      178
-#define WLC_SET_PROTECTION_CONTROL      179
-#define WLC_GET_PHYLIST             180
-#define WLC_ENCRYPT_STRENGTH            181
-#define WLC_DECRYPT_STATUS          182
-#define WLC_GET_KEY_SEQ             183
-#define WLC_GET_SCAN_CHANNEL_TIME       184
-#define WLC_SET_SCAN_CHANNEL_TIME       185
-#define WLC_GET_SCAN_UNASSOC_TIME       186
-#define WLC_SET_SCAN_UNASSOC_TIME       187
-#define WLC_GET_SCAN_HOME_TIME          188
-#define WLC_SET_SCAN_HOME_TIME          189
-#define WLC_GET_SCAN_NPROBES            190
-#define WLC_SET_SCAN_NPROBES            191
-#define WLC_GET_PRB_RESP_TIMEOUT        192
-#define WLC_SET_PRB_RESP_TIMEOUT        193
-#define WLC_GET_ATTEN               194
-#define WLC_SET_ATTEN               195
-#define WLC_GET_SHMEM               196
-#define WLC_SET_SHMEM               197
-
-
-#define WLC_SET_WSEC_TEST           200
-#define WLC_SCB_DEAUTHENTICATE_FOR_REASON   201
-#define WLC_TKIP_COUNTERMEASURES        202
-#define WLC_GET_PIOMODE             203
-#define WLC_SET_PIOMODE             204
-#define WLC_SET_ASSOC_PREFER            205
-#define WLC_GET_ASSOC_PREFER            206
-#define WLC_SET_ROAM_PREFER         207
-#define WLC_GET_ROAM_PREFER         208
-#define WLC_SET_LED             209
-#define WLC_GET_LED             210
-#define WLC_GET_INTERFERENCE_MODE       211
-#define WLC_SET_INTERFERENCE_MODE       212
-#define WLC_GET_CHANNEL_QA          213
-#define WLC_START_CHANNEL_QA            214
-#define WLC_GET_CHANNEL_SEL         215
-#define WLC_START_CHANNEL_SEL           216
-#define WLC_GET_VALID_CHANNELS          217
-#define WLC_GET_FAKEFRAG            218
-#define WLC_SET_FAKEFRAG            219
-#define WLC_GET_PWROUT_PERCENTAGE       220
-#define WLC_SET_PWROUT_PERCENTAGE       221
-#define WLC_SET_BAD_FRAME_PREEMPT       222
-#define WLC_GET_BAD_FRAME_PREEMPT       223
-#define WLC_SET_LEAP_LIST           224
-#define WLC_GET_LEAP_LIST           225
-#define WLC_GET_CWMIN               226
-#define WLC_SET_CWMIN               227
-#define WLC_GET_CWMAX               228
-#define WLC_SET_CWMAX               229
-#define WLC_GET_WET             230
-#define WLC_SET_WET             231
-#define WLC_GET_PUB             232
-
-
-#define WLC_GET_KEY_PRIMARY         235
-#define WLC_SET_KEY_PRIMARY         236
-
-#define WLC_GET_ACI_ARGS            238
-#define WLC_SET_ACI_ARGS            239
-#define WLC_UNSET_CALLBACK          240
-#define WLC_SET_CALLBACK            241
-#define WLC_GET_RADAR               242
-#define WLC_SET_RADAR               243
-#define WLC_SET_SPECT_MANAGMENT         244
-#define WLC_GET_SPECT_MANAGMENT         245
-#define WLC_WDS_GET_REMOTE_HWADDR       246
-#define WLC_WDS_GET_WPA_SUP         247
-#define WLC_SET_CS_SCAN_TIMER           248
-#define WLC_GET_CS_SCAN_TIMER           249
-#define WLC_MEASURE_REQUEST         250
-#define WLC_INIT                251
-#define WLC_SEND_QUIET              252
-#define WLC_KEEPALIVE           253
-#define WLC_SEND_PWR_CONSTRAINT         254
-#define WLC_UPGRADE_STATUS          255
-#define WLC_CURRENT_PWR             256
-#define WLC_GET_SCAN_PASSIVE_TIME       257
-#define WLC_SET_SCAN_PASSIVE_TIME       258
-#define WLC_LEGACY_LINK_BEHAVIOR        259
-#define WLC_GET_CHANNELS_IN_COUNTRY     260
-#define WLC_GET_COUNTRY_LIST            261
-#define WLC_GET_VAR             262
-#define WLC_SET_VAR             263
-#define WLC_NVRAM_GET               264
-#define WLC_NVRAM_SET               265
-#define WLC_NVRAM_DUMP              266
-#define WLC_REBOOT              267
-#define WLC_SET_WSEC_PMK            268
-#define WLC_GET_AUTH_MODE           269
-#define WLC_SET_AUTH_MODE           270
-#define WLC_GET_WAKEENTRY           271
-#define WLC_SET_WAKEENTRY           272
-#define WLC_NDCONFIG_ITEM           273
-#define WLC_NVOTPW              274
-#define WLC_OTPW                275
-#define WLC_IOV_BLOCK_GET           276
-#define WLC_IOV_MODULES_GET         277
-#define WLC_SOFT_RESET              278
-#define WLC_GET_ALLOW_MODE          279
-#define WLC_SET_ALLOW_MODE          280
-#define WLC_GET_DESIRED_BSSID           281
-#define WLC_SET_DESIRED_BSSID           282
-#define WLC_DISASSOC_MYAP           283
-#define WLC_GET_NBANDS              284
-#define WLC_GET_BANDSTATES          285
-#define WLC_GET_WLC_BSS_INFO            286
-#define WLC_GET_ASSOC_INFO          287
-#define WLC_GET_OID_PHY             288
-#define WLC_SET_OID_PHY             289
-#define WLC_SET_ASSOC_TIME          290
-#define WLC_GET_DESIRED_SSID            291
-#define WLC_GET_CHANSPEC            292
-#define WLC_GET_ASSOC_STATE         293
-#define WLC_SET_PHY_STATE           294
-#define WLC_GET_SCAN_PENDING            295
-#define WLC_GET_SCANREQ_PENDING         296
-#define WLC_GET_PREV_ROAM_REASON        297
-#define WLC_SET_PREV_ROAM_REASON        298
-#define WLC_GET_BANDSTATES_PI           299
-#define WLC_GET_PHY_STATE           300
-#define WLC_GET_BSS_WPA_RSN         301
-#define WLC_GET_BSS_WPA2_RSN            302
-#define WLC_GET_BSS_BCN_TS          303
-#define WLC_GET_INT_DISASSOC            304
-#define WLC_SET_NUM_PEERS           305
-#define WLC_GET_NUM_BSS             306
-#define WLC_NPHY_SAMPLE_COLLECT         307
-#define WLC_UM_PRIV             308
-#define WLC_GET_CMD             309
-
-#define WLC_SET_INTERFERENCE_OVERRIDE_MODE  311
-#define WLC_GET_INTERFERENCE_OVERRIDE_MODE  312
-#define WLC_GET_WAI_RESTRICT            313
-#define WLC_SET_WAI_RESTRICT            314
-#define WLC_SET_WAI_REKEY           315
-#define WLC_SET_PEAKRATE            316
-#define WLC_GET_PEAKRATE            317
-#define WLC_LAST                318
+/* #define WLC_DUMP_SCB				28 */ /* no longer supported */
+#define WLC_GET_CHANNEL				29
+#define WLC_SET_CHANNEL				30
+#define WLC_GET_SRL				31
+#define WLC_SET_SRL				32
+#define WLC_GET_LRL				33
+#define WLC_SET_LRL				34
+#define WLC_GET_PLCPHDR				35
+#define WLC_SET_PLCPHDR				36
+#define WLC_GET_RADIO				37
+#define WLC_SET_RADIO				38
+#define WLC_GET_PHYTYPE				39
+#define WLC_DUMP_RATE				40
+#define WLC_SET_RATE_PARAMS			41
+#define WLC_GET_FIXRATE				42
+#define WLC_SET_FIXRATE				43
+/* #define WLC_GET_WEP				42 */ /* no longer supported */
+/* #define WLC_SET_WEP				43 */ /* no longer supported */
+#define WLC_GET_KEY				44
+#define WLC_SET_KEY				45
+#define WLC_GET_REGULATORY			46
+#define WLC_SET_REGULATORY			47
+#define WLC_GET_PASSIVE_SCAN			48
+#define WLC_SET_PASSIVE_SCAN			49
+#define WLC_SCAN				50
+#define WLC_SCAN_RESULTS			51
+#define WLC_DISASSOC				52
+#define WLC_REASSOC				53
+#define WLC_GET_ROAM_TRIGGER			54
+#define WLC_SET_ROAM_TRIGGER			55
+#define WLC_GET_ROAM_DELTA			56
+#define WLC_SET_ROAM_DELTA			57
+#define WLC_GET_ROAM_SCAN_PERIOD		58
+#define WLC_SET_ROAM_SCAN_PERIOD		59
+#define WLC_EVM					60	/* diag */
+#define WLC_GET_TXANT				61
+#define WLC_SET_TXANT				62
+#define WLC_GET_ANTDIV				63
+#define WLC_SET_ANTDIV				64
+/* #define WLC_GET_TXPWR			65 */ /* no longer supported */
+/* #define WLC_SET_TXPWR			66 */ /* no longer supported */
+#define WLC_GET_CLOSED				67
+#define WLC_SET_CLOSED				68
+#define WLC_GET_MACLIST				69
+#define WLC_SET_MACLIST				70
+#define WLC_GET_RATESET				71
+#define WLC_SET_RATESET				72
+/* #define WLC_GET_LOCALE			73 */ /* no longer supported */
+#define WLC_LONGTRAIN				74
+#define WLC_GET_BCNPRD				75
+#define WLC_SET_BCNPRD				76
+#define WLC_GET_DTIMPRD				77
+#define WLC_SET_DTIMPRD				78
+#define WLC_GET_SROM				79
+#define WLC_SET_SROM				80
+#define WLC_GET_WEP_RESTRICT			81
+#define WLC_SET_WEP_RESTRICT			82
+#define WLC_GET_COUNTRY				83
+#define WLC_SET_COUNTRY				84
+#define WLC_GET_PM				85
+#define WLC_SET_PM				86
+#define WLC_GET_WAKE				87
+#define WLC_SET_WAKE				88
+/* #define WLC_GET_D11CNTS			89 */ /* -> "counters" iovar */
+#define WLC_GET_FORCELINK			90	/* ndis only */
+#define WLC_SET_FORCELINK			91	/* ndis only */
+#define WLC_FREQ_ACCURACY			92	/* diag */
+#define WLC_CARRIER_SUPPRESS			93	/* diag */
+#define WLC_GET_PHYREG				94
+#define WLC_SET_PHYREG				95
+#define WLC_GET_RADIOREG			96
+#define WLC_SET_RADIOREG			97
+#define WLC_GET_REVINFO				98
+#define WLC_GET_UCANTDIV			99
+#define WLC_SET_UCANTDIV			100
+#define WLC_R_REG				101
+#define WLC_W_REG				102
+/* #define WLC_DIAG_LOOPBACK			103	old tray diag */
+/* #define WLC_RESET_D11CNTS			104 */ /* -> "reset_d11cnts" iovar */
+#define WLC_GET_MACMODE				105
+#define WLC_SET_MACMODE				106
+#define WLC_GET_MONITOR				107
+#define WLC_SET_MONITOR				108
+#define WLC_GET_GMODE				109
+#define WLC_SET_GMODE				110
+#define WLC_GET_LEGACY_ERP			111
+#define WLC_SET_LEGACY_ERP			112
+#define WLC_GET_RX_ANT				113
+#define WLC_GET_CURR_RATESET			114	/* current rateset */
+#define WLC_GET_SCANSUPPRESS			115
+#define WLC_SET_SCANSUPPRESS			116
+#define WLC_GET_AP				117
+#define WLC_SET_AP				118
+#define WLC_GET_EAP_RESTRICT			119
+#define WLC_SET_EAP_RESTRICT			120
+#define WLC_SCB_AUTHORIZE			121
+#define WLC_SCB_DEAUTHORIZE			122
+#define WLC_GET_WDSLIST				123
+#define WLC_SET_WDSLIST				124
+#define WLC_GET_ATIM				125
+#define WLC_SET_ATIM				126
+#define WLC_GET_RSSI				127
+#define WLC_GET_PHYANTDIV			128
+#define WLC_SET_PHYANTDIV			129
+#define WLC_AP_RX_ONLY				130
+#define WLC_GET_TX_PATH_PWR			131
+#define WLC_SET_TX_PATH_PWR			132
+#define WLC_GET_WSEC				133
+#define WLC_SET_WSEC				134
+#define WLC_GET_PHY_NOISE			135
+#define WLC_GET_BSS_INFO			136
+#define WLC_GET_PKTCNTS				137
+#define WLC_GET_LAZYWDS				138
+#define WLC_SET_LAZYWDS				139
+#define WLC_GET_BANDLIST			140
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_GET_BAND				141
+#define WLC_SET_BAND				142
+#define WLC_SCB_DEAUTHENTICATE			143
+#define WLC_GET_SHORTSLOT			144
+#define WLC_GET_SHORTSLOT_OVERRIDE		145
+#define WLC_SET_SHORTSLOT_OVERRIDE		146
+#define WLC_GET_SHORTSLOT_RESTRICT		147
+#define WLC_SET_SHORTSLOT_RESTRICT		148
+#define WLC_GET_GMODE_PROTECTION		149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE	150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE	151
+#define WLC_UPGRADE				152
+/* #define WLC_GET_MRATE			153 */ /* no longer supported */
+/* #define WLC_SET_MRATE			154 */ /* no longer supported */
+#define WLC_GET_IGNORE_BCNS			155
+#define WLC_SET_IGNORE_BCNS			156
+#define WLC_GET_SCB_TIMEOUT			157
+#define WLC_SET_SCB_TIMEOUT			158
+#define WLC_GET_ASSOCLIST			159
+#define WLC_GET_CLK				160
+#define WLC_SET_CLK				161
+#define WLC_GET_UP				162
+#define WLC_OUT					163
+#define WLC_GET_WPA_AUTH			164
+#define WLC_SET_WPA_AUTH			165
+#define WLC_GET_UCFLAGS				166
+#define WLC_SET_UCFLAGS				167
+#define WLC_GET_PWRIDX				168
+#define WLC_SET_PWRIDX				169
+#define WLC_GET_TSSI				170
+#define WLC_GET_SUP_RATESET_OVERRIDE		171
+#define WLC_SET_SUP_RATESET_OVERRIDE		172
+/* #define WLC_SET_FAST_TIMER			173 */ /* no longer supported */
+/* #define WLC_GET_FAST_TIMER			174 */ /* no longer supported */
+/* #define WLC_SET_SLOW_TIMER			175 */ /* no longer supported */
+/* #define WLC_GET_SLOW_TIMER			176 */ /* no longer supported */
+/* #define WLC_DUMP_PHYREGS			177 */ /* no longer supported */
+#define WLC_GET_PROTECTION_CONTROL		178
+#define WLC_SET_PROTECTION_CONTROL		179
+#endif /* LINUX_POSTMOGRIFY_REMOVAL  */
+#define WLC_GET_PHYLIST				180
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_ENCRYPT_STRENGTH			181	/* ndis only */
+#define WLC_DECRYPT_STATUS			182	/* ndis only */
+#define WLC_GET_KEY_SEQ				183
+#define WLC_GET_SCAN_CHANNEL_TIME		184
+#define WLC_SET_SCAN_CHANNEL_TIME		185
+#define WLC_GET_SCAN_UNASSOC_TIME		186
+#define WLC_SET_SCAN_UNASSOC_TIME		187
+#define WLC_GET_SCAN_HOME_TIME			188
+#define WLC_SET_SCAN_HOME_TIME			189
+#define WLC_GET_SCAN_NPROBES			190
+#define WLC_SET_SCAN_NPROBES			191
+#define WLC_GET_PRB_RESP_TIMEOUT		192
+#define WLC_SET_PRB_RESP_TIMEOUT		193
+#define WLC_GET_ATTEN				194
+#define WLC_SET_ATTEN				195
+#define WLC_GET_SHMEM				196	/* diag */
+#define WLC_SET_SHMEM				197	/* diag */
+/* #define WLC_GET_GMODE_PROTECTION_CTS		198 */ /* no longer supported */
+/* #define WLC_SET_GMODE_PROTECTION_CTS		199 */ /* no longer supported */
+#define WLC_SET_WSEC_TEST			200
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_SCB_DEAUTHENTICATE_FOR_REASON	201
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_TKIP_COUNTERMEASURES		202
+#define WLC_GET_PIOMODE				203
+#define WLC_SET_PIOMODE				204
+#define WLC_SET_ASSOC_PREFER			205
+#define WLC_GET_ASSOC_PREFER			206
+#define WLC_SET_ROAM_PREFER			207
+#define WLC_GET_ROAM_PREFER			208
+#define WLC_SET_LED				209
+#define WLC_GET_LED				210
+#define WLC_GET_INTERFERENCE_MODE		211
+#define WLC_SET_INTERFERENCE_MODE		212
+#define WLC_GET_CHANNEL_QA			213
+#define WLC_START_CHANNEL_QA			214
+#define WLC_GET_CHANNEL_SEL			215
+#define WLC_START_CHANNEL_SEL			216
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_GET_VALID_CHANNELS			217
+#define WLC_GET_FAKEFRAG			218
+#define WLC_SET_FAKEFRAG			219
+#define WLC_GET_PWROUT_PERCENTAGE		220
+#define WLC_SET_PWROUT_PERCENTAGE		221
+#define WLC_SET_BAD_FRAME_PREEMPT		222
+#define WLC_GET_BAD_FRAME_PREEMPT		223
+#define WLC_SET_LEAP_LIST			224
+#define WLC_GET_LEAP_LIST			225
+#define WLC_GET_CWMIN				226
+#define WLC_SET_CWMIN				227
+#define WLC_GET_CWMAX				228
+#define WLC_SET_CWMAX				229
+#define WLC_GET_WET				230
+#define WLC_SET_WET				231
+#define WLC_GET_PUB				232
+/* #define WLC_SET_GLACIAL_TIMER		233 */ /* no longer supported */
+/* #define WLC_GET_GLACIAL_TIMER		234 */ /* no longer supported */
+#define WLC_GET_KEY_PRIMARY			235
+#define WLC_SET_KEY_PRIMARY			236
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+/* #define WLC_DUMP_RADIOREGS			237 */ /* no longer supported */
+#define WLC_GET_ACI_ARGS			238
+#define WLC_SET_ACI_ARGS			239
+#define WLC_UNSET_CALLBACK			240
+#define WLC_SET_CALLBACK			241
+#define WLC_GET_RADAR				242
+#define WLC_SET_RADAR				243
+#define WLC_SET_SPECT_MANAGMENT			244
+#define WLC_GET_SPECT_MANAGMENT			245
+#define WLC_WDS_GET_REMOTE_HWADDR		246	/* handled in wl_linux.c/wl_vx.c */
+#define WLC_WDS_GET_WPA_SUP			247
+#define WLC_SET_CS_SCAN_TIMER			248
+#define WLC_GET_CS_SCAN_TIMER			249
+#define WLC_MEASURE_REQUEST			250
+#define WLC_INIT				251
+#define WLC_SEND_QUIET				252
+#define WLC_KEEPALIVE			253
+#define WLC_SEND_PWR_CONSTRAINT			254
+#define WLC_UPGRADE_STATUS			255
+#define WLC_CURRENT_PWR				256
+#define WLC_GET_SCAN_PASSIVE_TIME		257
+#define WLC_SET_SCAN_PASSIVE_TIME		258
+#define WLC_LEGACY_LINK_BEHAVIOR		259
+#define WLC_GET_CHANNELS_IN_COUNTRY		260
+#define WLC_GET_COUNTRY_LIST			261
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_GET_VAR				262	/* get value of named variable */
+#define WLC_SET_VAR				263	/* set named variable to value */
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_NVRAM_GET				264	/* deprecated */
+#define WLC_NVRAM_SET				265
+#define WLC_NVRAM_DUMP				266
+#define WLC_REBOOT				267
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_SET_WSEC_PMK			268
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_GET_AUTH_MODE			269
+#define WLC_SET_AUTH_MODE			270
+#define WLC_GET_WAKEENTRY			271
+#define WLC_SET_WAKEENTRY			272
+#define WLC_NDCONFIG_ITEM			273	/* currently handled in wl_oid.c */
+#define WLC_NVOTPW				274
+#define WLC_OTPW				275
+#define WLC_IOV_BLOCK_GET			276
+#define WLC_IOV_MODULES_GET			277
+#define WLC_SOFT_RESET				278
+#define WLC_GET_ALLOW_MODE			279
+#define WLC_SET_ALLOW_MODE			280
+#define WLC_GET_DESIRED_BSSID			281
+#define WLC_SET_DESIRED_BSSID			282
+#define	WLC_DISASSOC_MYAP			283
+#define WLC_GET_NBANDS				284	/* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES			285	/* for Dongle EXT_STA support */
+#define WLC_GET_WLC_BSS_INFO			286	/* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_INFO			287	/* for Dongle EXT_STA support */
+#define WLC_GET_OID_PHY				288	/* for Dongle EXT_STA support */
+#define WLC_SET_OID_PHY				289	/* for Dongle EXT_STA support */
+#define WLC_SET_ASSOC_TIME			290	/* for Dongle EXT_STA support */
+#define WLC_GET_DESIRED_SSID			291	/* for Dongle EXT_STA support */
+#define WLC_GET_CHANSPEC			292	/* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_STATE			293	/* for Dongle EXT_STA support */
+#define WLC_SET_PHY_STATE			294	/* for Dongle EXT_STA support */
+#define WLC_GET_SCAN_PENDING			295	/* for Dongle EXT_STA support */
+#define WLC_GET_SCANREQ_PENDING			296	/* for Dongle EXT_STA support */
+#define WLC_GET_PREV_ROAM_REASON		297	/* for Dongle EXT_STA support */
+#define WLC_SET_PREV_ROAM_REASON		298	/* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES_PI			299	/* for Dongle EXT_STA support */
+#define WLC_GET_PHY_STATE			300	/* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA_RSN			301	/* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA2_RSN			302	/* for Dongle EXT_STA support */
+#define WLC_GET_BSS_BCN_TS			303	/* for Dongle EXT_STA support */
+#define WLC_GET_INT_DISASSOC			304	/* for Dongle EXT_STA support */
+#define WLC_SET_NUM_PEERS			305     /* for Dongle EXT_STA support */
+#define WLC_GET_NUM_BSS				306	/* for Dongle EXT_STA support */
+#define WLC_PHY_SAMPLE_COLLECT			307	/* phy sample collect mode */
+/* #define WLC_UM_PRIV				308 */	/* Deprecated: usermode driver */
+#define WLC_GET_CMD				309
+/* #define WLC_LAST				310 */	/* Never used - can be reused */
+#define WLC_SET_INTERFERENCE_OVERRIDE_MODE	311	/* set inter mode override */
+#define WLC_GET_INTERFERENCE_OVERRIDE_MODE	312	/* get inter mode override */
+/* #define WLC_GET_WAI_RESTRICT			313 */	/* for WAPI, deprecated use iovar instead */
+/* #define WLC_SET_WAI_RESTRICT			314 */	/* for WAPI, deprecated use iovar instead */
+/* #define WLC_SET_WAI_REKEY			315 */	/* for WAPI, deprecated use iovar instead */
+#define WLC_SET_NAT_CONFIG			316	/* for configuring NAT filter driver */
+#define WLC_GET_NAT_STATE			317
+#define WLC_GET_RSSI_QDB			318 /* qdB portion of the RSSI */
+#define WLC_LAST				319
 
 #ifndef EPICTRL_COOKIE
-#define EPICTRL_COOKIE      0xABADCEDE
+#define EPICTRL_COOKIE		0xABADCEDE
 #endif
 
-
+/* vx wlc ioctl's offset */
 #define CMN_IOCTL_OFF 0x180
 
+/*
+ * custom OID support
+ *
+ * 0xFF - implementation specific OID
+ * 0xE4 - first byte of Broadcom PCI vendor ID
+ * 0x14 - second byte of Broadcom PCI vendor ID
+ * 0xXX - the custom OID number
+ */
 
+/* begin 0x1f values beyond the start of the ET driver range. */
+#define WL_OID_BASE		0xFFE41420
 
-
-#define WL_OID_BASE     0xFFE41420
-
-
-#define OID_WL_GETINSTANCE  (WL_OID_BASE + WLC_GET_INSTANCE)
-#define OID_WL_GET_FORCELINK    (WL_OID_BASE + WLC_GET_FORCELINK)
-#define OID_WL_SET_FORCELINK    (WL_OID_BASE + WLC_SET_FORCELINK)
-#define OID_WL_ENCRYPT_STRENGTH (WL_OID_BASE + WLC_ENCRYPT_STRENGTH)
-#define OID_WL_DECRYPT_STATUS   (WL_OID_BASE + WLC_DECRYPT_STATUS)
+/* NDIS overrides */
+#define OID_WL_GETINSTANCE	(WL_OID_BASE + WLC_GET_INSTANCE)
+#define OID_WL_GET_FORCELINK	(WL_OID_BASE + WLC_GET_FORCELINK)
+#define OID_WL_SET_FORCELINK	(WL_OID_BASE + WLC_SET_FORCELINK)
+#define	OID_WL_ENCRYPT_STRENGTH	(WL_OID_BASE + WLC_ENCRYPT_STRENGTH)
+#define OID_WL_DECRYPT_STATUS	(WL_OID_BASE + WLC_DECRYPT_STATUS)
 #define OID_LEGACY_LINK_BEHAVIOR (WL_OID_BASE + WLC_LEGACY_LINK_BEHAVIOR)
-#define OID_WL_NDCONFIG_ITEM    (WL_OID_BASE + WLC_NDCONFIG_ITEM)
-
-
-#define OID_STA_CHANSPEC    (WL_OID_BASE + WLC_GET_CHANSPEC)
-#define OID_STA_NBANDS      (WL_OID_BASE + WLC_GET_NBANDS)
-#define OID_STA_GET_PHY     (WL_OID_BASE + WLC_GET_OID_PHY)
-#define OID_STA_SET_PHY     (WL_OID_BASE + WLC_SET_OID_PHY)
-#define OID_STA_ASSOC_TIME  (WL_OID_BASE + WLC_SET_ASSOC_TIME)
-#define OID_STA_DESIRED_SSID    (WL_OID_BASE + WLC_GET_DESIRED_SSID)
-#define OID_STA_SET_PHY_STATE   (WL_OID_BASE + WLC_SET_PHY_STATE)
-#define OID_STA_SCAN_PENDING    (WL_OID_BASE + WLC_GET_SCAN_PENDING)
+#define OID_WL_NDCONFIG_ITEM	(WL_OID_BASE + WLC_NDCONFIG_ITEM)
+
+/* EXT_STA Dongle suuport */
+#define OID_STA_CHANSPEC	(WL_OID_BASE + WLC_GET_CHANSPEC)
+#define OID_STA_NBANDS		(WL_OID_BASE + WLC_GET_NBANDS)
+#define OID_STA_GET_PHY		(WL_OID_BASE + WLC_GET_OID_PHY)
+#define OID_STA_SET_PHY		(WL_OID_BASE + WLC_SET_OID_PHY)
+#define OID_STA_ASSOC_TIME	(WL_OID_BASE + WLC_SET_ASSOC_TIME)
+#define OID_STA_DESIRED_SSID	(WL_OID_BASE + WLC_GET_DESIRED_SSID)
+#define OID_STA_SET_PHY_STATE	(WL_OID_BASE + WLC_SET_PHY_STATE)
+#define OID_STA_SCAN_PENDING	(WL_OID_BASE + WLC_GET_SCAN_PENDING)
 #define OID_STA_SCANREQ_PENDING (WL_OID_BASE + WLC_GET_SCANREQ_PENDING)
 #define OID_STA_GET_ROAM_REASON (WL_OID_BASE + WLC_GET_PREV_ROAM_REASON)
 #define OID_STA_SET_ROAM_REASON (WL_OID_BASE + WLC_SET_PREV_ROAM_REASON)
-#define OID_STA_GET_PHY_STATE   (WL_OID_BASE + WLC_GET_PHY_STATE)
-#define OID_STA_INT_DISASSOC    (WL_OID_BASE + WLC_GET_INT_DISASSOC)
-#define OID_STA_SET_NUM_PEERS   (WL_OID_BASE + WLC_SET_NUM_PEERS)
-#define OID_STA_GET_NUM_BSS (WL_OID_BASE + WLC_GET_NUM_BSS)
+#define OID_STA_GET_PHY_STATE	(WL_OID_BASE + WLC_GET_PHY_STATE)
+#define OID_STA_INT_DISASSOC	(WL_OID_BASE + WLC_GET_INT_DISASSOC)
+#define OID_STA_SET_NUM_PEERS	(WL_OID_BASE + WLC_SET_NUM_PEERS)
+#define OID_STA_GET_NUM_BSS	(WL_OID_BASE + WLC_GET_NUM_BSS)
 
+/* NAT filter driver support */
 #define OID_NAT_SET_CONFIG	(WL_OID_BASE + WLC_SET_NAT_CONFIG)
 #define OID_NAT_GET_STATE	(WL_OID_BASE + WLC_GET_NAT_STATE)
 
-#define WL_DECRYPT_STATUS_SUCCESS   1
-#define WL_DECRYPT_STATUS_FAILURE   2
-#define WL_DECRYPT_STATUS_UNKNOWN   3
+#define WL_DECRYPT_STATUS_SUCCESS	1
+#define WL_DECRYPT_STATUS_FAILURE	2
+#define WL_DECRYPT_STATUS_UNKNOWN	3
 
-
-#define WLC_UPGRADE_SUCCESS         0
-#define WLC_UPGRADE_PENDING         1
+/* allows user-mode app to poll the status of USB image upgrade */
+#define WLC_UPGRADE_SUCCESS			0
+#define WLC_UPGRADE_PENDING			1
 
 #ifdef CONFIG_USBRNDIS_RETAIL
-
+/* struct passed in for WLC_NDCONFIG_ITEM */
 typedef struct {
 	char *name;
 	void *param;
@@ -1446,187 +1734,264 @@ typedef struct {
 #endif
 
 
+/* WLC_GET_AUTH, WLC_SET_AUTH values */
+#define WL_AUTH_OPEN_SYSTEM		0	/* d11 open authentication */
+#define WL_AUTH_SHARED_KEY		1	/* d11 shared authentication */
+#define WL_AUTH_OPEN_SHARED		2	/* try open, then shared if open failed w/rc 13 */
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
-#define WL_AUTH_OPEN_SYSTEM     0
-#define WL_AUTH_SHARED_KEY      1
-#define WL_AUTH_OPEN_SHARED     2
+/* Bit masks for radio disabled status - returned by WL_GET_RADIO */
+#define WL_RADIO_SW_DISABLE		(1<<0)
+#define WL_RADIO_HW_DISABLE		(1<<1)
+#define WL_RADIO_MPC_DISABLE		(1<<2)
+#define WL_RADIO_COUNTRY_DISABLE	(1<<3)	/* some countries don't support any channel */
 
+#define	WL_SPURAVOID_OFF	0
+#define	WL_SPURAVOID_ON1	1
+#define	WL_SPURAVOID_ON2	2
 
-#define WL_RADIO_SW_DISABLE     (1<<0)
-#define WL_RADIO_HW_DISABLE     (1<<1)
-#define WL_RADIO_MPC_DISABLE        (1<<2)
-#define WL_RADIO_COUNTRY_DISABLE    (1<<3)
 
-#define WL_SPURAVOID_OFF    0
-#define WL_SPURAVOID_ON1    1
-#define WL_SPURAVOID_ON2    2
+#define WL_4335_SPURAVOID_ON1	1
+#define WL_4335_SPURAVOID_ON2	2
+#define WL_4335_SPURAVOID_ON3	3
+#define WL_4335_SPURAVOID_ON4	4
+#define WL_4335_SPURAVOID_ON5	5
+#define WL_4335_SPURAVOID_ON6	6
+#define WL_4335_SPURAVOID_ON7	7
+#define WL_4335_SPURAVOID_ON8	8
+#define WL_4335_SPURAVOID_ON9	9
 
-
-#define WL_TXPWR_OVERRIDE   (1U<<31)
+/* Override bit for WLC_SET_TXPWR.  if set, ignore other level limits */
+#define WL_TXPWR_OVERRIDE	(1U<<31)
 #define WL_TXPWR_NEG   (1U<<30)
 
-#define WL_PHY_PAVARS_LEN   6
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WL_PHY_PAVARS_LEN	32	/* Phy type, Band range, chain, a1[0], b0[0], b1[0] ... */
 
-#define WL_PHY_PAVARS2_NUM	3
-#define WL_PHY_PAVAR_VER	1
+#define WL_PHY_PAVAR_VER	1	/* pavars version */
+#define WL_PHY_PAVARS2_NUM	3	/* a1, b0, b1 */
 typedef struct wl_pavars2 {
-	uint16 ver;
-	uint16 len;
-	uint16 inuse;
-	uint16 phy_type;
+	uint16 ver;		/* version of this struct */
+	uint16 len;		/* len of this structure */
+	uint16 inuse;		/* driver return 1 for a1,b0,b1 in current band range */
+	uint16 phy_type;	/* phy type */
 	uint16 bandrange;
 	uint16 chain;
-	uint16 inpa[WL_PHY_PAVARS2_NUM];
+	uint16 inpa[WL_PHY_PAVARS2_NUM];	/* phy pavars for one band range */
 } wl_pavars2_t;
 
 typedef struct wl_po {
-	uint16  phy_type;
-	uint16  band;
-	uint16  cckpo;
-	uint32  ofdmpo;
-	uint16  mcspo[8];
+	uint16	phy_type;	/* Phy type */
+	uint16	band;
+	uint16	cckpo;
+	uint32	ofdmpo;
+	uint16	mcspo[8];
 } wl_po_t;
 
-
-#define WLC_TXPWR_MAX       (127)
-
-
-#define WL_DIAG_INTERRUPT           1
-#define WL_DIAG_LOOPBACK            2
-#define WL_DIAG_MEMORY              3
-#define WL_DIAG_LED             4
-#define WL_DIAG_REG             5
-#define WL_DIAG_SROM                6
-#define WL_DIAG_DMA             7
-
-#define WL_DIAGERR_SUCCESS          0
-#define WL_DIAGERR_FAIL_TO_RUN          1
-#define WL_DIAGERR_NOT_SUPPORTED        2
-#define WL_DIAGERR_INTERRUPT_FAIL       3
-#define WL_DIAGERR_LOOPBACK_FAIL        4
-#define WL_DIAGERR_SROM_FAIL            5
-#define WL_DIAGERR_SROM_BADCRC          6
-#define WL_DIAGERR_REG_FAIL         7
-#define WL_DIAGERR_MEMORY_FAIL          8
-#define WL_DIAGERR_NOMEM            9
-#define WL_DIAGERR_DMA_FAIL         10
-
-#define WL_DIAGERR_MEMORY_TIMEOUT       11
-#define WL_DIAGERR_MEMORY_BADPATTERN        12
-
-
-#define WLC_BAND_AUTO       0
-#define WLC_BAND_5G     1
-#define WLC_BAND_2G     2
-#define WLC_BAND_ALL        3
-
-
+/* a large TX Power as an init value to factor out of MIN() calculations,
+ * keep low enough to fit in an int8, units are .25 dBm
+ */
+#define WLC_TXPWR_MAX		(127)	/* ~32 dBm = 1,500 mW */
+
+/* "diag" iovar argument and error code */
+#define WL_DIAG_INTERRUPT			1	/* d11 loopback interrupt test */
+#define WL_DIAG_LOOPBACK			2	/* d11 loopback data test */
+#define WL_DIAG_MEMORY				3	/* d11 memory test */
+#define WL_DIAG_LED				4	/* LED test */
+#define WL_DIAG_REG				5	/* d11/phy register test */
+#define WL_DIAG_SROM				6	/* srom read/crc test */
+#define WL_DIAG_DMA				7	/* DMA test */
+#define WL_DIAG_LOOPBACK_EXT			8	/* enhenced d11 loopback data test */
+
+#define WL_DIAGERR_SUCCESS			0
+#define WL_DIAGERR_FAIL_TO_RUN			1	/* unable to run requested diag */
+#define WL_DIAGERR_NOT_SUPPORTED		2	/* diag requested is not supported */
+#define WL_DIAGERR_INTERRUPT_FAIL		3	/* loopback interrupt test failed */
+#define WL_DIAGERR_LOOPBACK_FAIL		4	/* loopback data test failed */
+#define WL_DIAGERR_SROM_FAIL			5	/* srom read failed */
+#define WL_DIAGERR_SROM_BADCRC			6	/* srom crc failed */
+#define WL_DIAGERR_REG_FAIL			7	/* d11/phy register test failed */
+#define WL_DIAGERR_MEMORY_FAIL			8	/* d11 memory test failed */
+#define WL_DIAGERR_NOMEM			9	/* diag test failed due to no memory */
+#define WL_DIAGERR_DMA_FAIL			10	/* DMA test failed */
+
+#define WL_DIAGERR_MEMORY_TIMEOUT		11	/* d11 memory test didn't finish in time */
+#define WL_DIAGERR_MEMORY_BADPATTERN		12	/* d11 memory test result in bad pattern */
+
+/* band types */
+#define	WLC_BAND_AUTO		0	/* auto-select */
+#define	WLC_BAND_5G		1	/* 5 Ghz */
+#define	WLC_BAND_2G		2	/* 2.4 Ghz */
+#define	WLC_BAND_ALL		3	/* all bands */
+
+/* band range returned by band_range iovar */
 #define WL_CHAN_FREQ_RANGE_2G      0
 #define WL_CHAN_FREQ_RANGE_5GL     1
 #define WL_CHAN_FREQ_RANGE_5GM     2
 #define WL_CHAN_FREQ_RANGE_5GH     3
 
-#define WL_CHAN_FREQ_RANGE_5GLL_VER2    4
-#define WL_CHAN_FREQ_RANGE_5GLH_VER2    5
-#define WL_CHAN_FREQ_RANGE_5GML_VER2    6
-#define WL_CHAN_FREQ_RANGE_5GMH_VER2    7
-#define WL_CHAN_FREQ_RANGE_5GH_VER2     8
-
-
-#define WLC_PHY_TYPE_A      0
-#define WLC_PHY_TYPE_B      1
-#define WLC_PHY_TYPE_G      2
-#define WLC_PHY_TYPE_N      4
-#define WLC_PHY_TYPE_LP     5
-#define WLC_PHY_TYPE_SSN    6
-#define WLC_PHY_TYPE_HT     7
-#define WLC_PHY_TYPE_LCN    8
-#define WLC_PHY_TYPE_NULL   0xf
-
-
-#define WLC_MACMODE_DISABLED    0
-#define WLC_MACMODE_DENY    1
-#define WLC_MACMODE_ALLOW   2
-
-
-#define GMODE_LEGACY_B      0
-#define GMODE_AUTO      1
-#define GMODE_ONLY      2
-#define GMODE_B_DEFERRED    3
-#define GMODE_PERFORMANCE   4
-#define GMODE_LRS       5
-#define GMODE_MAX       6
-
-
-#define WLC_PLCP_AUTO   -1
-#define WLC_PLCP_SHORT  0
-#define WLC_PLCP_LONG   1
-
-
-#define WLC_PROTECTION_AUTO     -1
-#define WLC_PROTECTION_OFF      0
-#define WLC_PROTECTION_ON       1
-#define WLC_PROTECTION_MMHDR_ONLY   2
-#define WLC_PROTECTION_CTS_ONLY     3
-
-
-#define WLC_PROTECTION_CTL_OFF      0
-#define WLC_PROTECTION_CTL_LOCAL    1
-#define WLC_PROTECTION_CTL_OVERLAP  2
-
-
-#define WLC_N_PROTECTION_OFF        0
-#define WLC_N_PROTECTION_OPTIONAL   1
-#define WLC_N_PROTECTION_20IN40     2
-#define WLC_N_PROTECTION_MIXEDMODE  3
+#define WL_CHAN_FREQ_RANGE_5GLL_5BAND    4
+#define WL_CHAN_FREQ_RANGE_5GLH_5BAND    5
+#define WL_CHAN_FREQ_RANGE_5GML_5BAND    6
+#define WL_CHAN_FREQ_RANGE_5GMH_5BAND    7
+#define WL_CHAN_FREQ_RANGE_5GH_5BAND     8
+
+#define WL_CHAN_FREQ_RANGE_5G_BAND0     1
+#define WL_CHAN_FREQ_RANGE_5G_BAND1     2
+#define WL_CHAN_FREQ_RANGE_5G_BAND2     3
+#define WL_CHAN_FREQ_RANGE_5G_BAND3     4
+
+#define WL_CHAN_FREQ_RANGE_5G_4BAND    	5
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* phy types (returned by WLC_GET_PHYTPE) */
+#define	WLC_PHY_TYPE_A		0
+#define	WLC_PHY_TYPE_B		1
+#define	WLC_PHY_TYPE_G		2
+#define	WLC_PHY_TYPE_N		4
+#define	WLC_PHY_TYPE_LP		5
+#define	WLC_PHY_TYPE_SSN	6
+#define	WLC_PHY_TYPE_HT		7
+#define	WLC_PHY_TYPE_LCN	8
+#define	WLC_PHY_TYPE_LCN40	10
+#define WLC_PHY_TYPE_AC		11
+#define	WLC_PHY_TYPE_NULL	0xf
+
+/* Values for PM */
+#define PM_OFF	0
+#define PM_MAX	1
+#define PM_FAST 2
+#define PM_FORCE_OFF 3 		/* use this bit to force PM off even bt is active */
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* MAC list modes */
+#define WLC_MACMODE_DISABLED	0	/* MAC list disabled */
+#define WLC_MACMODE_DENY	1	/* Deny specified (i.e. allow unspecified) */
+#define WLC_MACMODE_ALLOW	2	/* Allow specified (i.e. deny unspecified) */
 
-#define WLC_N_PREAMBLE_MIXEDMODE    0
-#define WLC_N_PREAMBLE_GF       1
+/*
+ * 54g modes (basic bits may still be overridden)
+ *
+ * GMODE_LEGACY_B			Rateset: 1b, 2b, 5.5, 11
+ *					Preamble: Long
+ *					Shortslot: Off
+ * GMODE_AUTO				Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *					Extended Rateset: 6, 9, 12, 48
+ *					Preamble: Long
+ *					Shortslot: Auto
+ * GMODE_ONLY				Rateset: 1b, 2b, 5.5b, 11b, 18, 24b, 36, 54
+ *					Extended Rateset: 6b, 9, 12b, 48
+ *					Preamble: Short required
+ *					Shortslot: Auto
+ * GMODE_B_DEFERRED			Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *					Extended Rateset: 6, 9, 12, 48
+ *					Preamble: Long
+ *					Shortslot: On
+ * GMODE_PERFORMANCE			Rateset: 1b, 2b, 5.5b, 6b, 9, 11b, 12b, 18, 24b, 36, 48, 54
+ *					Preamble: Short required
+ *					Shortslot: On and required
+ * GMODE_LRS				Rateset: 1b, 2b, 5.5b, 11b
+ *					Extended Rateset: 6, 9, 12, 18, 24, 36, 48, 54
+ *					Preamble: Long
+ *					Shortslot: Auto
+ */
+#define GMODE_LEGACY_B		0
+#define GMODE_AUTO		1
+#define GMODE_ONLY		2
+#define GMODE_B_DEFERRED	3
+#define GMODE_PERFORMANCE	4
+#define GMODE_LRS		5
+#define GMODE_MAX		6
+
+/* values for PLCPHdr_override */
+#define WLC_PLCP_AUTO	-1
+#define WLC_PLCP_SHORT	0
+#define WLC_PLCP_LONG	1
+
+/* values for g_protection_override and n_protection_override */
+#define WLC_PROTECTION_AUTO		-1
+#define WLC_PROTECTION_OFF		0
+#define WLC_PROTECTION_ON		1
+#define WLC_PROTECTION_MMHDR_ONLY	2
+#define WLC_PROTECTION_CTS_ONLY		3
+
+/* values for g_protection_control and n_protection_control */
+#define WLC_PROTECTION_CTL_OFF		0
+#define WLC_PROTECTION_CTL_LOCAL	1
+#define WLC_PROTECTION_CTL_OVERLAP	2
+
+/* values for n_protection */
+#define WLC_N_PROTECTION_OFF		0
+#define WLC_N_PROTECTION_OPTIONAL	1
+#define WLC_N_PROTECTION_20IN40		2
+#define WLC_N_PROTECTION_MIXEDMODE	3
+
+/* values for n_preamble_type */
+#define WLC_N_PREAMBLE_MIXEDMODE	0
+#define WLC_N_PREAMBLE_GF		1
 #define WLC_N_PREAMBLE_GF_BRCM          2
 
-
-#define WLC_N_BW_20ALL          0
-#define WLC_N_BW_40ALL          1
-#define WLC_N_BW_20IN2G_40IN5G      2
-
-
-#define WLC_N_TXRX_CHAIN0       0
-#define WLC_N_TXRX_CHAIN1       1
-
-
-#define WLC_N_SGI_20            0x01
-#define WLC_N_SGI_40            0x02
-
-
-#define PM_OFF  0
-#define PM_MAX  1
-#define PM_FAST 2
-
-#define LISTEN_INTERVAL			20
-
-#define INTERFERE_OVRRIDE_OFF   -1
-#define INTERFERE_NONE  0
-#define NON_WLAN    1
-#define WLAN_MANUAL 2
-#define WLAN_AUTO   3
-#define WLAN_AUTO_W_NOISE   4
-#define AUTO_ACTIVE (1 << 7)
+/* values for band specific 40MHz capabilities (deprecated) */
+#define WLC_N_BW_20ALL			0
+#define WLC_N_BW_40ALL			1
+#define WLC_N_BW_20IN2G_40IN5G		2
+
+#define WLC_BW_20MHZ_BIT		(1<<0)
+#define WLC_BW_40MHZ_BIT		(1<<1)
+#define WLC_BW_80MHZ_BIT		(1<<2)
+
+/* Bandwidth capabilities */
+#define WLC_BW_CAP_20MHZ		(WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_40MHZ		(WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_80MHZ		(WLC_BW_80MHZ_BIT|WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_UNRESTRICTED		0xFF
+
+#define WL_BW_CAP_20MHZ(bw_cap)	(((bw_cap) & WLC_BW_20MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_40MHZ(bw_cap)	(((bw_cap) & WLC_BW_40MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_80MHZ(bw_cap)	(((bw_cap) & WLC_BW_80MHZ_BIT) ? TRUE : FALSE)
+
+/* values to force tx/rx chain */
+#define WLC_N_TXRX_CHAIN0		0
+#define WLC_N_TXRX_CHAIN1		1
+
+/* bitflags for SGI support (sgi_rx iovar) */
+#define WLC_N_SGI_20			0x01
+#define WLC_N_SGI_40			0x02
+#define WLC_VHT_SGI_80			0x04
+
+/* when sgi_tx==WLC_SGI_ALL, bypass rate selection, enable sgi for all mcs */
+#define WLC_SGI_ALL				0x02
+
+#define LISTEN_INTERVAL			10
+/* interference mitigation options */
+#define	INTERFERE_OVRRIDE_OFF	-1	/* interference override off */
+#define	INTERFERE_NONE	0	/* off */
+#define	NON_WLAN	1	/* foreign/non 802.11 interference, no auto detect */
+#define	WLAN_MANUAL	2	/* ACI: no auto detection */
+#define	WLAN_AUTO	3	/* ACI: auto detect */
+#define	WLAN_AUTO_W_NOISE	4	/* ACI: auto - detect and non 802.11 interference */
+#define AUTO_ACTIVE	(1 << 7) /* Auto is currently active */
+
+/* AP environment */
+#define AP_ENV_DETECT_NOT_USED		0 /* We aren't using AP environment detection */
+#define AP_ENV_DENSE			1 /* "Corporate" or other AP dense environment */
+#define AP_ENV_SPARSE			2 /* "Home" or other sparse environment */
+#define AP_ENV_INDETERMINATE		3 /* AP environment hasn't been identified */
 
 typedef struct wl_aci_args {
-	int enter_aci_thresh;
-	int exit_aci_thresh;
-	int usec_spin;
-	int glitch_delay;
-	uint16 nphy_adcpwr_enter_thresh;
-	uint16 nphy_adcpwr_exit_thresh;
-	uint16 nphy_repeat_ctr;
-	uint16 nphy_num_samples;
-	uint16 nphy_undetect_window_sz;
-	uint16 nphy_b_energy_lo_aci;
-	uint16 nphy_b_energy_md_aci;
-	uint16 nphy_b_energy_hi_aci;
-	uint16 nphy_noise_noassoc_glitch_th_up;
+	int enter_aci_thresh; /* Trigger level to start detecting ACI */
+	int exit_aci_thresh; /* Trigger level to exit ACI mode */
+	int usec_spin; /* microsecs to delay between rssi samples */
+	int glitch_delay; /* interval between ACI scans when glitch count is consistently high */
+	uint16 nphy_adcpwr_enter_thresh;	/* ADC power to enter ACI mitigation mode */
+	uint16 nphy_adcpwr_exit_thresh;	/* ADC power to exit ACI mitigation mode */
+	uint16 nphy_repeat_ctr;		/* Number of tries per channel to compute power */
+	uint16 nphy_num_samples;	/* Number of samples to compute power on one channel */
+	uint16 nphy_undetect_window_sz;	/* num of undetects to exit ACI Mitigation mode */
+	uint16 nphy_b_energy_lo_aci;	/* low ACI power energy threshold for bphy */
+	uint16 nphy_b_energy_md_aci;	/* mid ACI power energy threshold for bphy */
+	uint16 nphy_b_energy_hi_aci;	/* high ACI power energy threshold for bphy */
+	uint16 nphy_noise_noassoc_glitch_th_up; /* wl interference 4 */
 	uint16 nphy_noise_noassoc_glitch_th_dn;
 	uint16 nphy_noise_assoc_glitch_th_up;
 	uint16 nphy_noise_assoc_glitch_th_dn;
@@ -1640,23 +2005,23 @@ typedef struct wl_aci_args {
 	uint16 nphy_noise_crsidx_decr;
 } wl_aci_args_t;
 
-#define TRIGGER_NOW             0
-#define TRIGGER_CRS             0x01
-#define TRIGGER_CRSDEASSERT         0x02
-#define TRIGGER_GOODFCS             0x04
-#define TRIGGER_BADFCS              0x08
-#define TRIGGER_BADPLCP             0x10
-#define TRIGGER_CRSGLITCH           0x20
-#define WL_ACI_ARGS_LEGACY_LENGTH   16
-#define WL_SAMPLECOLLECT_T_VERSION  1
+#define TRIGGER_NOW				0
+#define TRIGGER_CRS				0x01
+#define TRIGGER_CRSDEASSERT			0x02
+#define TRIGGER_GOODFCS				0x04
+#define TRIGGER_BADFCS				0x08
+#define TRIGGER_BADPLCP				0x10
+#define TRIGGER_CRSGLITCH			0x20
+#define WL_ACI_ARGS_LEGACY_LENGTH	16	/* bytes of pre NPHY aci args */
+#define	WL_SAMPLECOLLECT_T_VERSION	2	/* version of wl_samplecollect_args_t struct */
 typedef struct wl_samplecollect_args {
-
+	/* version 0 fields */
 	uint8 coll_us;
 	int cores;
-
-	uint16 version;
-	uint16 length;
-	uint8 trigger;
+	/* add'l version 1 fields */
+	uint16 version;     /* see definition of WL_SAMPLECOLLECT_T_VERSION */
+	uint16 length;      /* length of entire structure */
+	int8 trigger;
 	uint16 timeout;
 	uint16 mode;
 	uint32 pre_dur;
@@ -1664,351 +2029,1515 @@ typedef struct wl_samplecollect_args {
 	uint8 gpio_sel;
 	bool downsamp;
 	bool be_deaf;
-	bool agc;
-	bool filter;
+	bool agc;		/* loop from init gain and going down */
+	bool filter;		/* override high pass corners to lowest */
+	/* add'l version 2 fields */
+	uint8 trigger_state;
+	uint8 module_sel1;
+	uint8 module_sel2;
+	uint16 nsamps;
+	int bitStart;
+	uint32 gpioCapMask;
 } wl_samplecollect_args_t;
 
-#define WL_SAMPLEDATA_HEADER_TYPE   1
-#define WL_SAMPLEDATA_HEADER_SIZE   80
-#define WL_SAMPLEDATA_TYPE      2
-#define WL_SAMPLEDATA_SEQ       0xff
-#define WL_SAMPLEDATA_MORE_DATA     0x100
-#define WL_SAMPLEDATA_T_VERSION     1
-
-#define WL_SAMPLEDATA_T_VERSION_SPEC_AN 2
+#define	WL_SAMPLEDATA_HEADER_TYPE	1
+#define WL_SAMPLEDATA_HEADER_SIZE	80	/* sample collect header size (bytes) */
+#define	WL_SAMPLEDATA_TYPE		2
+#define	WL_SAMPLEDATA_SEQ		0xff	/* sequence # */
+#define	WL_SAMPLEDATA_MORE_DATA		0x100	/* more data mask */
+#define	WL_SAMPLEDATA_T_VERSION		1	/* version of wl_samplecollect_args_t struct */
+/* version for unpacked sample data, int16 {(I,Q),Core(0..N)} */
+#define	WL_SAMPLEDATA_T_VERSION_SPEC_AN 2
 
 typedef struct wl_sampledata {
-	uint16 version;
-	uint16 size;
-	uint16 tag;
-	uint16 length;
-	uint32 flag;
+	uint16 version;	/* structure version */
+	uint16 size;	/* size of structure */
+	uint16 tag;	/* Header/Data */
+	uint16 length;	/* data length */
+	uint32 flag;	/* bit def */
 } wl_sampledata_t;
 
+/* WL_OTA START */
 
+#define WL_OTA_ARG_PARSE_BLK_SIZE 	1200
+#define WL_OTA_TEST_MAX_NUM_RATE	30
+#define WL_OTA_TEST_MAX_NUM_SEQ		100
 
-#define WL_ERROR_VAL        0x00000001
-#define WL_TRACE_VAL        0x00000002
-#define WL_PRHDRS_VAL       0x00000004
-#define WL_PRPKT_VAL        0x00000008
-#define WL_INFORM_VAL       0x00000010
-#define WL_TMP_VAL      0x00000020
-#define WL_OID_VAL      0x00000040
-#define WL_RATE_VAL     0x00000080
-#define WL_ASSOC_VAL        0x00000100
-#define WL_PRUSR_VAL        0x00000200
-#define WL_PS_VAL       0x00000400
-#define WL_TXPWR_VAL        0x00000800
-#define WL_PORT_VAL     0x00001000
-#define WL_DUAL_VAL     0x00002000
-#define WL_WSEC_VAL     0x00004000
-#define WL_WSEC_DUMP_VAL    0x00008000
-#define WL_LOG_VAL      0x00010000
-#define WL_NRSSI_VAL        0x00020000
-#define WL_LOFT_VAL     0x00040000
-#define WL_REGULATORY_VAL   0x00080000
-#define WL_PHYCAL_VAL       0x00100000
-#define WL_RADAR_VAL        0x00200000
-#define WL_MPC_VAL      0x00400000
-#define WL_APSTA_VAL        0x00800000
-#define WL_DFS_VAL      0x01000000
-#define WL_BA_VAL       0x02000000
-#define WL_ACI_VAL      0x04000000
-#define WL_MBSS_VAL     0x04000000
-#define WL_CAC_VAL      0x08000000
-#define WL_AMSDU_VAL        0x10000000
-#define WL_AMPDU_VAL        0x20000000
-#define WL_FFPLD_VAL        0x40000000
-
+/* OTA Test Status */
+enum {
+	WL_OTA_TEST_IDLE,	/* Default Idle state */
+	WL_OTA_TEST_ACTIVE,	/* Test Running */
+	WL_OTA_TEST_SUCCESS,	/* Successfully Finished Test */
+	WL_OTA_TEST_FAIL	/* Test Failed in the Middle */
+};
+/* OTA SYNC Status */
+enum {
+	WL_OTA_SYNC_IDLE,	/* Idle state */
+	WL_OTA_SYNC_ACTIVE,	/* Waiting for Sync */
+	WL_OTA_SYNC_FAIL	/* Sync pkt not recieved */
+};
 
-#define WL_DPT_VAL      0x00000001
-#define WL_SCAN_VAL     0x00000002
-#define WL_WOWL_VAL     0x00000004
-#define WL_COEX_VAL     0x00000008
-#define WL_RTDC_VAL     0x00000010
-#define WL_PROTO_VAL        0x00000020
-#define WL_BTA_VAL      0x00000040
-#define WL_CHANINT_VAL      0x00000080
-#define WL_THERMAL_VAL      0x00000100
-#define WL_P2P_VAL      0x00000200
-#define WL_TXRX_VAL		0x00000400
-#define WL_MCHAN_VAL            0x00000800
+/* Various error states dut can get stuck during test */
+enum {
+	WL_OTA_SKIP_TEST_CAL_FAIL = 1,		/* Phy calibration failed */
+	WL_OTA_SKIP_TEST_SYNCH_FAIL,		/* Sync Packet not recieved */
+	WL_OTA_SKIP_TEST_FILE_DWNLD_FAIL,	/* Cmd flow file download failed */
+	WL_OTA_SKIP_TEST_NO_TEST_FOUND,	/* No test found in Flow file */
+	WL_OTA_SKIP_TEST_WL_NOT_UP,		/* WL UP failed */
+	WL_OTA_SKIP_TEST_UNKNOWN_CALL		/* Unintentional scheduling on ota test */
+};
 
+/* Differentiator for ota_tx and ota_rx */
+enum {
+	WL_OTA_TEST_TX,		/* ota_tx */
+	WL_OTA_TEST_RX		/* ota_rx */
+};
 
-#define WL_LED_NUMGPIO      16
+/* Catch 3 modes of operation: 20Mhz, 40Mhz, 20 in 40 Mhz */
+enum {
+	WL_OTA_TEST_BW_20_IN_40MHZ,	/* 20 in 40 operation */
+	WL_OTA_TEST_BW_20MHZ,		/* 20 Mhz operation */
+	WL_OTA_TEST_BW_40MHZ		/* full 40Mhz operation */
+};
+typedef struct ota_rate_info {
+	uint8 rate_cnt;					/* Total number of rates */
+	uint8 rate_val_mbps[WL_OTA_TEST_MAX_NUM_RATE];	/* array of rates from 1mbps to 130mbps */
+							/* for legacy rates : ratein mbps * 2 */
+							/* for HT rates : mcs index */
+} ota_rate_info_t;
+
+typedef struct ota_power_info {
+	int8 pwr_ctrl_on;	/* power control on/off */
+	int8 start_pwr;		/* starting power/index */
+	int8 delta_pwr;		/* delta power/index */
+	int8 end_pwr;		/* end power/index */
+} ota_power_info_t;
+
+typedef struct ota_packetengine {
+	uint16 delay;           /* Inter-packet delay */
+				/* for ota_tx, delay is tx ifs in micro seconds */
+				/* for ota_rx, delay is wait time in milliseconds */
+	uint16 nframes;         /* Number of frames */
+	uint16 length;          /* Packet length */
+} ota_packetengine_t;
+
+/* Test info vector */
+typedef struct wl_ota_test_args {
+	uint8 cur_test;			/* test phase */
+	uint8 chan;			/* channel */
+	uint8 bw;			/* bandwidth */
+	char control_band;		/* control band */
+	uint8 stf_mode;			/* stf mode */
+	ota_rate_info_t rt_info;	/* Rate info */
+	ota_packetengine_t pkteng;	/* packeteng info */
+	uint8 txant;			/* tx antenna */
+	uint8 rxant;			/* rx antenna */
+	ota_power_info_t pwr_info;	/* power sweep info */
+	uint8 wait_for_sync;		/* wait for sync or not */
+} wl_ota_test_args_t;
+
+typedef struct wl_ota_test_vector {
+	wl_ota_test_args_t test_arg[WL_OTA_TEST_MAX_NUM_SEQ];	/* Test argument struct */
+	uint16 test_cnt;					/* Total no of test */
+	bool file_dwnld_valid;					/* File successfully downloaded */
+	uint8 sync_timeout;					/* sync packet timeout */
+	int8 sync_fail_action;					/* sync fail action */
+	struct ether_addr sync_mac;				/* macaddress for sync pkt */
+	struct ether_addr tx_mac;				/* macaddress for tx */
+	struct ether_addr rx_mac;				/* macaddress for rx */
+	int8 loop_test;					/* dbg feature to loop the test */
+} wl_ota_test_vector_t;
+
+
+/* struct copied back form dongle to host to query the status */
+typedef struct wl_ota_test_status {
+	int16 cur_test_cnt;		/* test phase */
+	int8 skip_test_reason;		/* skip test reasoin */
+	wl_ota_test_args_t test_arg;	/* cur test arg details */
+	uint16 test_cnt;		/* total no of test downloaded */
+	bool file_dwnld_valid;		/* file successfully downloaded ? */
+	uint8 sync_timeout;		/* sync timeout */
+	int8 sync_fail_action;		/* sync fail action */
+	struct ether_addr sync_mac;	/* macaddress for sync pkt */
+	struct ether_addr tx_mac;	/* tx mac address */
+	struct ether_addr rx_mac;	/* rx mac address */
+	uint8  test_stage;		/* check the test status */
+	int8 loop_test;		/* Debug feature to puts test enfine in a loop */
+	uint8 sync_status;		/* sync status */
+} wl_ota_test_status_t;
+
+/* WL_OTA END */
+
+/* wl_radar_args_t */
+typedef struct {
+	int npulses; 	/* required number of pulses at n * t_int */
+	int ncontig; 	/* required number of pulses at t_int */
+	int min_pw; 	/* minimum pulse width (20 MHz clocks) */
+	int max_pw; 	/* maximum pulse width (20 MHz clocks) */
+	uint16 thresh0;	/* Radar detection, thresh 0 */
+	uint16 thresh1;	/* Radar detection, thresh 1 */
+	uint16 blank;	/* Radar detection, blank control */
+	uint16 fmdemodcfg;	/* Radar detection, fmdemod config */
+	int npulses_lp;  /* Radar detection, minimum long pulses */
+	int min_pw_lp; /* Minimum pulsewidth for long pulses */
+	int max_pw_lp; /* Maximum pulsewidth for long pulses */
+	int min_fm_lp; /* Minimum fm for long pulses */
+	int max_span_lp;  /* Maximum deltat for long pulses */
+	int min_deltat; /* Minimum spacing between pulses */
+	int max_deltat; /* Maximum spacing between pulses */
+	uint16 autocorr;	/* Radar detection, autocorr on or off */
+	uint16 st_level_time;	/* Radar detection, start_timing level */
+	uint16 t2_min; /* minimum clocks needed to remain in state 2 */
+	uint32 version; /* version */
+	uint32 fra_pulse_err;	/* sample error margin for detecting French radar pulsed */
+	int npulses_fra;  /* Radar detection, minimum French pulses set */
+	int npulses_stg2;  /* Radar detection, minimum staggered-2 pulses set */
+	int npulses_stg3;  /* Radar detection, minimum staggered-3 pulses set */
+	uint16 percal_mask;	/* defines which period cal is masked from radar detection */
+	int quant;	/* quantization resolution to pulse positions */
+	uint32 min_burst_intv_lp;	/* minimum burst to burst interval for bin3 radar */
+	uint32 max_burst_intv_lp;	/* maximum burst to burst interval for bin3 radar */
+	int nskip_rst_lp;	/* number of skipped pulses before resetting lp buffer */
+	int max_pw_tol;	/* maximum tollerance allowed in detected pulse width for radar detection */
+	uint16 feature_mask; /* 16-bit mask to specify enabled features */
+} wl_radar_args_t;
+
+#define WL_RADAR_ARGS_VERSION 2
 
+typedef struct {
+	uint32 version; /* version */
+	uint16 thresh0_20_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 20MHz */
+	uint16 thresh1_20_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 20MHz */
+	uint16 thresh0_40_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 40MHz */
+	uint16 thresh1_40_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 40MHz */
+	uint16 thresh0_80_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 80MHz */
+	uint16 thresh1_80_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 80MHz */
+	uint16 thresh0_160_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 160MHz */
+	uint16 thresh1_160_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 160MHz */
+	uint16 thresh0_20_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 20MHz */
+	uint16 thresh1_20_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 20MHz */
+	uint16 thresh0_40_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 40MHz */
+	uint16 thresh1_40_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 40MHz */
+	uint16 thresh0_80_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 80MHz */
+	uint16 thresh1_80_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 80MHz */
+	uint16 thresh0_160_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 160MHz */
+	uint16 thresh1_160_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 160MHz */
+} wl_radar_thr_t;
+
+#define WL_RADAR_THR_VERSION	2
+#define WL_THRESHOLD_LO_BAND	70	/* range from 5250MHz - 5350MHz */
+
+/* radar iovar SET defines */
+#define WL_RADAR_DETECTOR_OFF		0	/* radar detector off */
+#define WL_RADAR_DETECTOR_ON		1	/* radar detector on */
+#define WL_RADAR_SIMULATED		2	/* force radar detector to declare
+						 * detection once
+						 */
+#define WL_RSSI_ANT_VERSION	1	/* current version of wl_rssi_ant_t */
+#define WL_ANT_RX_MAX		2	/* max 2 receive antennas */
+#define WL_ANT_HT_RX_MAX	3	/* max 3 receive antennas/cores */
+#define WL_ANT_IDX_1		0	/* antenna index 1 */
+#define WL_ANT_IDX_2		1	/* antenna index 2 */
+
+#ifndef WL_RSSI_ANT_MAX
+#define WL_RSSI_ANT_MAX		4	/* max possible rx antennas */
+#elif WL_RSSI_ANT_MAX != 4
+#error "WL_RSSI_ANT_MAX does not match"
+#endif
 
-#define WL_LED_OFF      0
-#define WL_LED_ON       1
-#define WL_LED_ACTIVITY     2
-#define WL_LED_RADIO        3
-#define WL_LED_ARADIO       4
-#define WL_LED_BRADIO       5
-#define WL_LED_BGMODE       6
-#define WL_LED_WI1      7
-#define WL_LED_WI2      8
-#define WL_LED_WI3      9
-#define WL_LED_ASSOC        10
-#define WL_LED_INACTIVE     11
-#define WL_LED_ASSOCACT     12
-#define WL_LED_WI4      13
-#define WL_LED_WI5      14
-#define WL_LED_BLINKSLOW    15
-#define WL_LED_BLINKMED     16
-#define WL_LED_BLINKFAST    17
-#define WL_LED_BLINKCUSTOM  18
-#define WL_LED_BLINKPERIODIC    19
-#define WL_LED_ASSOC_WITH_SEC   20
+/* RSSI per antenna */
+typedef struct {
+	uint32	version;		/* version field */
+	uint32	count;			/* number of valid antenna rssi */
+	int8 rssi_ant[WL_RSSI_ANT_MAX];	/* rssi per antenna */
+} wl_rssi_ant_t;
 
-#define WL_LED_START_OFF    21
-#define WL_LED_NUMBEHAVIOR  22
+/* dfs_status iovar-related defines */
 
+/* cac - channel availability check,
+ * ism - in-service monitoring
+ * csa - channel switching announcement
+ */
 
-#define WL_LED_BEH_MASK     0x7f
-#define WL_LED_AL_MASK      0x80
+/* cac state values */
+#define WL_DFS_CACSTATE_IDLE		0	/* state for operating in non-radar channel */
+#define	WL_DFS_CACSTATE_PREISM_CAC	1	/* CAC in progress */
+#define WL_DFS_CACSTATE_ISM		2	/* ISM in progress */
+#define WL_DFS_CACSTATE_CSA		3	/* csa */
+#define WL_DFS_CACSTATE_POSTISM_CAC	4	/* ISM CAC */
+#define WL_DFS_CACSTATE_PREISM_OOC	5	/* PREISM OOC */
+#define WL_DFS_CACSTATE_POSTISM_OOC	6	/* POSTISM OOC */
+#define WL_DFS_CACSTATES		7	/* this many states exist */
+
+/* data structure used in 'dfs_status' wl interface, which is used to query dfs status */
+typedef struct {
+	uint state;		/* noted by WL_DFS_CACSTATE_XX. */
+	uint duration;		/* time spent in ms in state. */
+	/* as dfs enters ISM state, it removes the operational channel from quiet channel
+	 * list and notes the channel in channel_cleared. set to 0 if no channel is cleared
+	 */
+	chanspec_t chanspec_cleared;
+	/* chanspec cleared used to be a uint, add another to uint16 to maintain size */
+	uint16 pad;
+} wl_dfs_status_t;
+
+#define NUM_PWRCTRL_RATES 12
 
+typedef struct {
+	uint8 txpwr_band_max[NUM_PWRCTRL_RATES];	/* User set target */
+	uint8 txpwr_limit[NUM_PWRCTRL_RATES];		/* reg and local power limit */
+	uint8 txpwr_local_max;				/* local max according to the AP */
+	uint8 txpwr_local_constraint;			/* local constraint according to the AP */
+	uint8 txpwr_chan_reg_max;			/* Regulatory max for this channel */
+	uint8 txpwr_target[2][NUM_PWRCTRL_RATES];	/* Latest target for 2.4 and 5 Ghz */
+	uint8 txpwr_est_Pout[2];			/* Latest estimate for 2.4 and 5 Ghz */
+	uint8 txpwr_opo[NUM_PWRCTRL_RATES];		/* On G phy, OFDM power offset */
+	uint8 txpwr_bphy_cck_max[NUM_PWRCTRL_RATES];	/* Max CCK power for this band (SROM) */
+	uint8 txpwr_bphy_ofdm_max;			/* Max OFDM power for this band (SROM) */
+	uint8 txpwr_aphy_max[NUM_PWRCTRL_RATES];	/* Max power for A band (SROM) */
+	int8  txpwr_antgain[2];				/* Ant gain for each band - from SROM */
+	uint8 txpwr_est_Pout_gofdm;			/* Pwr estimate for 2.4 OFDM */
+} tx_power_legacy_t;
+
+#define WL_TX_POWER_RATES_LEGACY    45
+#define WL_TX_POWER_MCS20_FIRST         12
+#define WL_TX_POWER_MCS20_NUM           16
+#define WL_TX_POWER_MCS40_FIRST         28
+#define WL_TX_POWER_MCS40_NUM           17
 
-#define WL_NUMCHANNELS      64
-#define WL_NUMCHANSPECS     100
+typedef struct {
+	uint32 flags;
+	chanspec_t chanspec;                 /* txpwr report for this channel */
+	chanspec_t local_chanspec;           /* channel on which we are associated */
+	uint8 local_max;                 /* local max according to the AP */
+	uint8 local_constraint;              /* local constraint according to the AP */
+	int8  antgain[2];                /* Ant gain for each band - from SROM */
+	uint8 rf_cores;                  /* count of RF Cores being reported */
+	uint8 est_Pout[4];                           /* Latest tx power out estimate per RF
+							  * chain without adjustment
+							  */
+	uint8 est_Pout_cck;                          /* Latest CCK tx power out estimate */
+	uint8 user_limit[WL_TX_POWER_RATES_LEGACY];  /* User limit */
+	uint8 reg_limit[WL_TX_POWER_RATES_LEGACY];   /* Regulatory power limit */
+	uint8 board_limit[WL_TX_POWER_RATES_LEGACY]; /* Max power board can support (SROM) */
+	uint8 target[WL_TX_POWER_RATES_LEGACY];      /* Latest target power */
+} tx_power_legacy2_t;
+
+/* TX Power index defines */
+#define WL_NUM_RATES_CCK			4 /* 1, 2, 5.5, 11 Mbps */
+#define WL_NUM_RATES_OFDM			8 /* 6, 9, 12, 18, 24, 36, 48, 54 Mbps SISO/CDD */
+#define WL_NUM_RATES_MCS_1STREAM	8 /* MCS 0-7 1-stream rates - SISO/CDD/STBC/MCS */
+#define WL_NUM_RATES_EXTRA_VHT		2 /* Additional VHT 11AC rates */
+#define WL_NUM_RATES_VHT			10
+#define WL_NUM_RATES_MCS32			1
+
+#define WLC_NUM_RATES_CCK       WL_NUM_RATES_CCK
+#define WLC_NUM_RATES_OFDM      WL_NUM_RATES_OFDM
+#define WLC_NUM_RATES_MCS_1_STREAM  WL_NUM_RATES_MCS_1STREAM
+#define WLC_NUM_RATES_MCS_2_STREAM  WL_NUM_RATES_MCS_1STREAM
+#define WLC_NUM_RATES_MCS32     WL_NUM_RATES_MCS32
+#define WL_TX_POWER_CCK_NUM     WL_NUM_RATES_CCK
+#define WL_TX_POWER_OFDM_NUM        WL_NUM_RATES_OFDM
+#define WL_TX_POWER_MCS_1_STREAM_NUM    WL_NUM_RATES_MCS_1STREAM
+#define WL_TX_POWER_MCS_2_STREAM_NUM    WL_NUM_RATES_MCS_1STREAM
+#define WL_TX_POWER_MCS_32_NUM      WL_NUM_RATES_MCS32
+
+#define WL_NUM_2x2_ELEMENTS		4
+#define WL_NUM_3x3_ELEMENTS		6
+
+typedef struct txppr {
+	/* start of 20MHz tx power limits */
+	int8 b20_1x1dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20_1x1ofdm[WL_NUM_RATES_OFDM];		/* Legacy OFDM transmission */
+	int8 b20_1x1mcs0[WL_NUM_RATES_MCS_1STREAM];		/* SISO MCS 0-7 */
+
+	int8 b20_1x2dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20_1x2cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b20_1x2cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* CDD MCS 0-7 */
+	int8 b20_2x2stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b20_2x2sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* MCS 8-15 */
+
+	int8 b20_1x3dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20_1x3cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b20_1x3cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* 1 Nsts to 3 Tx Chain */
+	int8 b20_2x3stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b20_2x3sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* 2 Nsts to 3 Tx Chain */
+	int8 b20_3x3sdm_mcs16[WL_NUM_RATES_MCS_1STREAM];	/* 3 Nsts to 3 Tx Chain */
+
+	int8 b20_1x1vht[WL_NUM_RATES_EXTRA_VHT];		/* VHT8_9SS1 */
+	int8 b20_1x2cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD1 */
+	int8 b20_2x2stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC */
+	int8 b20_2x2sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2 */
+	int8 b20_1x3cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD2 */
+	int8 b20_2x3stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC_SPEXP1 */
+	int8 b20_2x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2_SPEXP1 */
+	int8 b20_3x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS3 */
+
+	/* start of 40MHz tx power limits */
+	int8 b40_dummy1x1dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b40_1x1ofdm[WL_NUM_RATES_OFDM];		/* Legacy OFDM transmission */
+	int8 b40_1x1mcs0[WL_NUM_RATES_MCS_1STREAM];		/* SISO MCS 0-7 */
+
+	int8 b40_dummy1x2dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b40_1x2cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b40_1x2cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* CDD MCS 0-7 */
+	int8 b40_2x2stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b40_2x2sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* MCS 8-15 */
+
+	int8 b40_dummy1x3dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b40_1x3cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b40_1x3cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* 1 Nsts to 3 Tx Chain */
+	int8 b40_2x3stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b40_2x3sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* 2 Nsts to 3 Tx Chain */
+	int8 b40_3x3sdm_mcs16[WL_NUM_RATES_MCS_1STREAM];	/* 3 Nsts to 3 Tx Chain */
+
+	int8 b40_1x1vht[WL_NUM_RATES_EXTRA_VHT];		/* VHT8_9SS1 */
+	int8 b40_1x2cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD1 */
+	int8 b40_2x2stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC */
+	int8 b40_2x2sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2 */
+	int8 b40_1x3cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD2 */
+	int8 b40_2x3stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC_SPEXP1 */
+	int8 b40_2x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2_SPEXP1 */
+	int8 b40_3x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS3 */
+
+	/* start of 20in40MHz tx power limits */
+	int8 b20in40_1x1dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b20in40_1x1ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM transmission */
+	int8 b20in40_1x1mcs0[WL_NUM_RATES_MCS_1STREAM];	/* SISO MCS 0-7 */
+
+	int8 b20in40_1x2dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20in40_1x2cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b20in40_1x2cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* CDD MCS 0-7 */
+	int8 b20in40_2x2stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b20in40_2x2sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* MCS 8-15 */
+
+	int8 b20in40_1x3dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20in40_1x3cdd_ofdm[WL_NUM_RATES_OFDM];	/* 20 in 40 MHz Legacy OFDM CDD */
+	int8 b20in40_1x3cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* 1 Nsts to 3 Tx Chain */
+	int8 b20in40_2x3stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b20in40_2x3sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* 2 Nsts to 3 Tx Chain */
+	int8 b20in40_3x3sdm_mcs16[WL_NUM_RATES_MCS_1STREAM];	/* 3 Nsts to 3 Tx Chain */
+
+	int8 b20in40_1x1vht[WL_NUM_RATES_EXTRA_VHT];		/* VHT8_9SS1 */
+	int8 b20in40_1x2cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD1 */
+	int8 b20in40_2x2stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC */
+	int8 b20in40_2x2sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2 */
+	int8 b20in40_1x3cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD2 */
+	int8 b20in40_2x3stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC_SPEXP1 */
+	int8 b20in40_2x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2_SPEXP1 */
+	int8 b20in40_3x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS3 */
+
+	/* start of 80MHz tx power limits */
+	int8 b80_dummy1x1dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b80_1x1ofdm[WL_NUM_RATES_OFDM];			/* Legacy OFDM transmission */
+	int8 b80_1x1mcs0[WL_NUM_RATES_MCS_1STREAM];	/* SISO MCS 0-7 */
+
+	int8 b80_dummy1x2dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b80_1x2cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b80_1x2cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* CDD MCS 0-7 */
+	int8 b80_2x2stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b80_2x2sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* MCS 8-15 */
+
+	int8 b80_dummy1x3dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b80_1x3cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b80_1x3cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* 1 Nsts to 3 Tx Chain */
+	int8 b80_2x3stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b80_2x3sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* 2 Nsts to 3 Tx Chain */
+	int8 b80_3x3sdm_mcs16[WL_NUM_RATES_MCS_1STREAM];	/* 3 Nsts to 3 Tx Chain */
+
+	int8 b80_1x1vht[WL_NUM_RATES_EXTRA_VHT];		/* VHT8_9SS1 */
+	int8 b80_1x2cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD1 */
+	int8 b80_2x2stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC */
+	int8 b80_2x2sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2 */
+	int8 b80_1x3cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD2 */
+	int8 b80_2x3stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC_SPEXP1 */
+	int8 b80_2x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2_SPEXP1 */
+	int8 b80_3x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS3 */
+
+	/* start of 20in80MHz tx power limits */
+	int8 b20in80_1x1dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b20in80_1x1ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM transmission */
+	int8 b20in80_1x1mcs0[WL_NUM_RATES_MCS_1STREAM];	/* SISO MCS 0-7 */
+
+	int8 b20in80_1x2dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20in80_1x2cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b20in80_1x2cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* CDD MCS 0-7 */
+	int8 b20in80_2x2stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b20in80_2x2sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* MCS 8-15 */
+
+	int8 b20in80_1x3dsss[WL_NUM_RATES_CCK];		/* Legacy CCK/DSSS */
+	int8 b20in80_1x3cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b20in80_1x3cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* 1 Nsts to 3 Tx Chain */
+	int8 b20in80_2x3stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b20in80_2x3sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* 2 Nsts to 3 Tx Chain */
+	int8 b20in80_3x3sdm_mcs16[WL_NUM_RATES_MCS_1STREAM];	/* 3 Nsts to 3 Tx Chain */
+
+	int8 b20in80_1x1vht[WL_NUM_RATES_EXTRA_VHT];		/* VHT8_9SS1 */
+	int8 b20in80_1x2cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD1 */
+	int8 b20in80_2x2stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC */
+	int8 b20in80_2x2sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2 */
+	int8 b20in80_1x3cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD2 */
+	int8 b20in80_2x3stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC_SPEXP1 */
+	int8 b20in80_2x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2_SPEXP1 */
+	int8 b20in80_3x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS3 */
+
+	/* start of 40in80MHz tx power limits */
+	int8 b40in80_dummy1x1dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b40in80_1x1ofdm[WL_NUM_RATES_OFDM];		/* Legacy OFDM transmission */
+	int8 b40in80_1x1mcs0[WL_NUM_RATES_MCS_1STREAM];	/* SISO MCS 0-7 */
+
+	int8 b40in80_dummy1x2dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b40in80_1x2cdd_ofdm[WL_NUM_RATES_OFDM];	/* Legacy OFDM CDD transmission */
+	int8 b40in80_1x2cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* CDD MCS 0-7 */
+	int8 b40in80_2x2stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b40in80_2x2sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* MCS 8-15 */
+
+	int8 b40in80_dummy1x3dsss[WL_NUM_RATES_CCK];	/* Legacy CCK/DSSS */
+	int8 b40in80_1x3cdd_ofdm[WL_NUM_RATES_OFDM];	/* MHz Legacy OFDM CDD */
+	int8 b40in80_1x3cdd_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* 1 Nsts to 3 Tx Chain */
+	int8 b40in80_2x3stbc_mcs0[WL_NUM_RATES_MCS_1STREAM];	/* STBC MCS 0-7 */
+	int8 b40in80_2x3sdm_mcs8[WL_NUM_RATES_MCS_1STREAM];	/* 2 Nsts to 3 Tx Chain */
+	int8 b40in80_3x3sdm_mcs16[WL_NUM_RATES_MCS_1STREAM];	/* 3 Nsts to 3 Tx Chain */
+
+	int8 b40in80_1x1vht[WL_NUM_RATES_EXTRA_VHT];		/* VHT8_9SS1 */
+	int8 b40in80_1x2cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD1 */
+	int8 b40in80_2x2stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC */
+	int8 b40in80_2x2sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2 */
+	int8 b40in80_1x3cdd_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_CDD2 */
+	int8 b40in80_2x3stbc_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS1_STBC_SPEXP1 */
+	int8 b40in80_2x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS2_SPEXP1 */
+	int8 b40in80_3x3sdm_vht[WL_NUM_RATES_EXTRA_VHT];	/* VHT8_9SS3 */
+
+	int8 mcs32; /* C_CHECK - THIS NEEDS TO BE REMOVED THROUGHOUT THE CODE */
+} txppr_t;
+
+/* 20MHz */
+#define WL_TX_POWER_CCK_FIRST					OFFSETOF(txppr_t, b20_1x1dsss)
+#define WL_TX_POWER_OFDM20_FIRST				OFFSETOF(txppr_t, b20_1x1ofdm)
+#define WL_TX_POWER_MCS20_SISO_FIRST			OFFSETOF(txppr_t, b20_1x1mcs0)
+#define WL_TX_POWER_20_S1x1_FIRST				OFFSETOF(txppr_t, b20_1x1mcs0)
+
+#define WL_TX_POWER_CCK_CDD_S1x2_FIRST			OFFSETOF(txppr_t, b20_1x2dsss)
+#define WL_TX_POWER_OFDM20_CDD_FIRST			OFFSETOF(txppr_t, b20_1x2cdd_ofdm)
+#define WL_TX_POWER_MCS20_CDD_FIRST				OFFSETOF(txppr_t, b20_1x2cdd_mcs0)
+#define WL_TX_POWER_20_S1x2_FIRST				OFFSETOF(txppr_t, b20_1x2cdd_mcs0)
+#define WL_TX_POWER_MCS20_STBC_FIRST			OFFSETOF(txppr_t, b20_2x2stbc_mcs0)
+#define WL_TX_POWER_MCS20_SDM_FIRST				OFFSETOF(txppr_t, b20_2x2sdm_mcs8)
+#define WL_TX_POWER_20_S2x2_FIRST				OFFSETOF(txppr_t, b20_2x2sdm_mcs8)
+
+#define WL_TX_POWER_CCK_CDD_S1x3_FIRST			OFFSETOF(txppr_t, b20_1x3dsss)
+#define WL_TX_POWER_OFDM20_CDD_S1x3_FIRST		OFFSETOF(txppr_t, b20_1x3cdd_ofdm)
+#define WL_TX_POWER_20_S1x3_FIRST				OFFSETOF(txppr_t, b20_1x3cdd_mcs0)
+#define WL_TX_POWER_20_STBC_S2x3_FIRST			OFFSETOF(txppr_t, b20_2x3stbc_mcs0)
+#define WL_TX_POWER_20_S2x3_FIRST				OFFSETOF(txppr_t, b20_2x3sdm_mcs8)
+#define WL_TX_POWER_20_S3x3_FIRST				OFFSETOF(txppr_t, b20_3x3sdm_mcs16)
+
+#define WL_TX_POWER_20_S1X1_VHT					OFFSETOF(txppr_t, b20_1x1vht)
+#define WL_TX_POWER_20_S1X2_CDD_VHT				OFFSETOF(txppr_t, b20_1x2cdd_vht)
+#define WL_TX_POWER_20_S2X2_STBC_VHT			OFFSETOF(txppr_t, b20_2x2stbc_vht)
+#define WL_TX_POWER_20_S2X2_VHT					OFFSETOF(txppr_t, b20_2x2sdm_vht)
+#define WL_TX_POWER_20_S1X3_CDD_VHT				OFFSETOF(txppr_t, b20_1x3cdd_vht)
+#define WL_TX_POWER_20_S2X3_STBC_VHT			OFFSETOF(txppr_t, b20_2x3stbc_vht)
+#define WL_TX_POWER_20_S2X3_VHT					OFFSETOF(txppr_t, b20_2x3sdm_vht)
+#define WL_TX_POWER_20_S3X3_VHT					OFFSETOF(txppr_t, b20_3x3sdm_vht)
+
+/* 40MHz */
+#define WL_TX_POWER_40_DUMMY_CCK_FIRST			OFFSETOF(txppr_t, b40_dummy1x1dsss)
+#define WL_TX_POWER_OFDM40_FIRST				OFFSETOF(txppr_t, b40_1x1ofdm)
+#define WL_TX_POWER_MCS40_SISO_FIRST			OFFSETOF(txppr_t, b40_1x1mcs0)
+#define WL_TX_POWER_40_S1x1_FIRST				OFFSETOF(txppr_t, b40_1x1mcs0)
+
+#define WL_TX_POWER_40_DUMMY_CCK_CDD_S1x2_FIRST	OFFSETOF(txppr_t, b40_dummy1x2dsss)
+#define WL_TX_POWER_OFDM40_CDD_FIRST			OFFSETOF(txppr_t, b40_1x2cdd_ofdm)
+#define WL_TX_POWER_MCS40_CDD_FIRST				OFFSETOF(txppr_t, b40_1x2cdd_mcs0)
+#define WL_TX_POWER_40_S1x2_FIRST				OFFSETOF(txppr_t, b40_1x2cdd_mcs0)
+#define WL_TX_POWER_MCS40_STBC_FIRST			OFFSETOF(txppr_t, b40_2x2stbc_mcs0)
+#define WL_TX_POWER_MCS40_SDM_FIRST				OFFSETOF(txppr_t, b40_2x2sdm_mcs8)
+#define WL_TX_POWER_40_S2x2_FIRST				OFFSETOF(txppr_t, b40_2x2sdm_mcs8)
+
+#define WL_TX_POWER_40_DUMMY_CCK_CDD_S1x3_FIRST	OFFSETOF(txppr_t, b40_dummy1x3dsss)
+#define WL_TX_POWER_OFDM40_CDD_S1x3_FIRST		OFFSETOF(txppr_t, b40_1x3cdd_ofdm)
+#define WL_TX_POWER_40_S1x3_FIRST				OFFSETOF(txppr_t, b40_1x3cdd_mcs0)
+#define WL_TX_POWER_40_STBC_S2x3_FIRST			OFFSETOF(txppr_t, b40_2x3stbc_mcs0)
+#define WL_TX_POWER_40_S2x3_FIRST				OFFSETOF(txppr_t, b40_2x3sdm_mcs8)
+#define WL_TX_POWER_40_S3x3_FIRST				OFFSETOF(txppr_t, b40_3x3sdm_mcs16)
+
+#define WL_TX_POWER_40_S1X1_VHT					OFFSETOF(txppr_t, b40_1x1vht)
+#define WL_TX_POWER_40_S1X2_CDD_VHT				OFFSETOF(txppr_t, b40_1x2cdd_vht)
+#define WL_TX_POWER_40_S2X2_STBC_VHT			OFFSETOF(txppr_t, b40_2x2stbc_vht)
+#define WL_TX_POWER_40_S2X2_VHT					OFFSETOF(txppr_t, b40_2x2sdm_vht)
+#define WL_TX_POWER_40_S1X3_CDD_VHT				OFFSETOF(txppr_t, b40_1x3cdd_vht)
+#define WL_TX_POWER_40_S2X3_STBC_VHT			OFFSETOF(txppr_t, b40_2x3stbc_vht)
+#define WL_TX_POWER_40_S2X3_VHT					OFFSETOF(txppr_t, b40_2x3sdm_vht)
+#define WL_TX_POWER_40_S3X3_VHT					OFFSETOF(txppr_t, b40_3x3sdm_vht)
+
+/* 20 in 40MHz */
+#define WL_TX_POWER_20UL_CCK_FIRST				OFFSETOF(txppr_t, b20in40_1x1dsss)
+#define WL_TX_POWER_20UL_OFDM_FIRST				OFFSETOF(txppr_t, b20in40_1x1ofdm)
+#define WL_TX_POWER_20UL_S1x1_FIRST				OFFSETOF(txppr_t, b20in40_1x1mcs0)
+
+#define WL_TX_POWER_CCK_20U_CDD_S1x2_FIRST	OFFSETOF(txppr_t, b20in40_1x2dsss)
+#define WL_TX_POWER_20UL_OFDM_CDD_FIRST		OFFSETOF(txppr_t, b20in40_1x2cdd_ofdm)
+#define WL_TX_POWER_20UL_S1x2_FIRST			OFFSETOF(txppr_t, b20in40_1x2cdd_mcs0)
+#define WL_TX_POWER_20UL_STBC_S2x2_FIRST	OFFSETOF(txppr_t, b20in40_2x2stbc_mcs0)
+#define WL_TX_POWER_20UL_S2x2_FIRST			OFFSETOF(txppr_t, b20in40_2x2sdm_mcs8)
+
+#define WL_TX_POWER_CCK_20U_CDD_S1x3_FIRST	OFFSETOF(txppr_t, b20in40_1x3dsss)
+#define WL_TX_POWER_20UL_OFDM_CDD_S1x3_FIRST OFFSETOF(txppr_t, b20in40_1x3cdd_ofdm)
+#define WL_TX_POWER_20UL_S1x3_FIRST			OFFSETOF(txppr_t, b20in40_1x3cdd_mcs0)
+#define WL_TX_POWER_20UL_STBC_S2x3_FIRST	OFFSETOF(txppr_t, b20in40_2x3stbc_mcs0)
+#define WL_TX_POWER_20UL_S2x3_FIRST			OFFSETOF(txppr_t, b20in40_2x3sdm_mcs8)
+#define WL_TX_POWER_20UL_S3x3_FIRST			OFFSETOF(txppr_t, b20in40_3x3sdm_mcs16)
+
+#define WL_TX_POWER_20UL_S1X1_VHT			OFFSETOF(txppr_t, b20in40_1x1vht)
+#define WL_TX_POWER_20UL_S1X2_CDD_VHT		OFFSETOF(txppr_t, b20in40_1x2cdd_vht)
+#define WL_TX_POWER_20UL_S2X2_STBC_VHT		OFFSETOF(txppr_t, b20in40_2x2stbc_vht)
+#define WL_TX_POWER_20UL_S2X2_VHT			OFFSETOF(txppr_t, b20in40_2x2sdm_vht)
+#define WL_TX_POWER_20UL_S1X3_CDD_VHT		OFFSETOF(txppr_t, b20in40_1x3cdd_vht)
+#define WL_TX_POWER_20UL_S2X3_STBC_VHT		OFFSETOF(txppr_t, b20in40_2x3stbc_vht)
+#define WL_TX_POWER_20UL_S2X3_VHT			OFFSETOF(txppr_t, b20in40_2x3sdm_vht)
+#define WL_TX_POWER_20UL_S3X3_VHT			OFFSETOF(txppr_t, b20in40_3x3sdm_vht)
+
+/* 80MHz */
+#define WL_TX_POWER_80_DUMMY_CCK_FIRST		OFFSETOF(txppr_t, b80_dummy1x1dsss)
+#define WL_TX_POWER_OFDM80_FIRST			OFFSETOF(txppr_t, b80_1x1ofdm)
+#define WL_TX_POWER_MCS80_SISO_FIRST		OFFSETOF(txppr_t, b80_1x1mcs0)
+#define WL_TX_POWER_80_S1x1_FIRST			OFFSETOF(txppr_t, b80_1x1mcs0)
+
+#define WL_TX_POWER_80_DUMMY_CCK_CDD_S1x2_FIRST	OFFSETOF(txppr_t, b80_dummy1x2dsss)
+#define WL_TX_POWER_OFDM80_CDD_FIRST			OFFSETOF(txppr_t, b80_1x2cdd_ofdm)
+#define WL_TX_POWER_MCS80_CDD_FIRST				OFFSETOF(txppr_t, b80_1x2cdd_mcs0)
+#define WL_TX_POWER_80_S1x2_FIRST				OFFSETOF(txppr_t, b80_1x2cdd_mcs0)
+#define WL_TX_POWER_MCS80_STBC_FIRST			OFFSETOF(txppr_t, b80_2x2stbc_mcs0)
+#define WL_TX_POWER_MCS80_SDM_FIRST				OFFSETOF(txppr_t, b80_2x2sdm_mcs8)
+#define WL_TX_POWER_80_S2x2_FIRST				OFFSETOF(txppr_t, b80_2x2sdm_mcs8)
+
+#define WL_TX_POWER_80_DUMMY_CCK_CDD_S1x3_FIRST	OFFSETOF(txppr_t, b80_dummy1x3dsss)
+#define WL_TX_POWER_OFDM80_CDD_S1x3_FIRST		OFFSETOF(txppr_t, b80_1x3cdd_ofdm)
+#define WL_TX_POWER_80_S1x3_FIRST				OFFSETOF(txppr_t, b80_1x3cdd_mcs0)
+#define WL_TX_POWER_80_STBC_S2x3_FIRST			OFFSETOF(txppr_t, b80_2x3stbc_mcs0)
+#define WL_TX_POWER_80_S2x3_FIRST				OFFSETOF(txppr_t, b80_2x3sdm_mcs8)
+#define WL_TX_POWER_80_S3x3_FIRST				OFFSETOF(txppr_t, b80_3x3sdm_mcs16)
+
+#define WL_TX_POWER_80_S1X1_VHT					OFFSETOF(txppr_t, b80_1x1vht)
+#define WL_TX_POWER_80_S1X2_CDD_VHT				OFFSETOF(txppr_t, b80_1x2cdd_vht)
+#define WL_TX_POWER_80_S2X2_STBC_VHT			OFFSETOF(txppr_t, b80_2x2stbc_vht)
+#define WL_TX_POWER_80_S2X2_VHT					OFFSETOF(txppr_t, b80_2x2sdm_vht)
+#define WL_TX_POWER_80_S1X3_CDD_VHT				OFFSETOF(txppr_t, b80_1x3cdd_vht)
+#define WL_TX_POWER_80_S2X3_STBC_VHT			OFFSETOF(txppr_t, b80_2x3stbc_vht)
+#define WL_TX_POWER_80_S2X3_VHT					OFFSETOF(txppr_t, b80_2x3sdm_vht)
+#define WL_TX_POWER_80_S3X3_VHT					OFFSETOF(txppr_t, b80_3x3sdm_vht)
+
+/* 20 in 80MHz */
+#define WL_TX_POWER_20UUL_CCK_FIRST				OFFSETOF(txppr_t, b20in80_1x1dsss)
+#define WL_TX_POWER_20UUL_OFDM_FIRST			OFFSETOF(txppr_t, b20in80_1x1ofdm)
+#define WL_TX_POWER_20UUL_S1x1_FIRST			OFFSETOF(txppr_t, b20in80_1x1mcs0)
+
+#define WL_TX_POWER_CCK_20UU_CDD_S1x2_FIRST		OFFSETOF(txppr_t, b20in80_1x2dsss)
+#define WL_TX_POWER_20UUL_OFDM_CDD_FIRST		OFFSETOF(txppr_t, b20in80_1x2cdd_ofdm)
+#define WL_TX_POWER_20UUL_S1x2_FIRST			OFFSETOF(txppr_t, b20in80_1x2cdd_mcs0)
+#define WL_TX_POWER_20UUL_STBC_S2x2_FIRST		OFFSETOF(txppr_t, b20in80_2x2stbc_mcs0)
+#define WL_TX_POWER_20UUL_S2x2_FIRST			OFFSETOF(txppr_t, b20in80_2x2sdm_mcs8)
+
+#define WL_TX_POWER_CCK_20UU_CDD_S1x3_FIRST		OFFSETOF(txppr_t, b20in80_1x3dsss)
+#define WL_TX_POWER_20UUL_OFDM_CDD_S1x3_FIRST	OFFSETOF(txppr_t, b20in80_1x3cdd_ofdm)
+#define WL_TX_POWER_20UUL_S1x3_FIRST			OFFSETOF(txppr_t, b20in80_1x3cdd_mcs0)
+#define WL_TX_POWER_20UUL_STBC_S2x3_FIRST		OFFSETOF(txppr_t, b20in80_2x3stbc_mcs0)
+#define WL_TX_POWER_20UUL_S2x3_FIRST			OFFSETOF(txppr_t, b20in80_2x3sdm_mcs8)
+#define WL_TX_POWER_20UUL_S3x3_FIRST			OFFSETOF(txppr_t, b20in80_3x3sdm_mcs16)
+
+#define WL_TX_POWER_20UUL_S1X1_VHT			OFFSETOF(txppr_t, b20in80_1x1vht)
+#define WL_TX_POWER_20UUL_S1X2_CDD_VHT		OFFSETOF(txppr_t, b20in80_1x2cdd_vht)
+#define WL_TX_POWER_20UUL_S2X2_STBC_VHT		OFFSETOF(txppr_t, b20in80_2x2stbc_vht)
+#define WL_TX_POWER_20UUL_S2X2_VHT			OFFSETOF(txppr_t, b20in80_2x2sdm_vht)
+#define WL_TX_POWER_20UUL_S1X3_CDD_VHT		OFFSETOF(txppr_t, b20in80_1x3cdd_vht)
+#define WL_TX_POWER_20UUL_S2X3_STBC_VHT		OFFSETOF(txppr_t, b20in80_2x3stbc_vht)
+#define WL_TX_POWER_20UUL_S2X3_VHT			OFFSETOF(txppr_t, b20in80_2x3sdm_vht)
+#define WL_TX_POWER_20UUL_S3X3_VHT			OFFSETOF(txppr_t, b20in80_3x3sdm_vht)
+
+/* 40 in 80MHz */
+#define WL_TX_POWER_40UUL_DUMMY_CCK_FIRST		OFFSETOF(txppr_t, b40in80_dummy1x1dsss)
+#define WL_TX_POWER_40UUL_OFDM_FIRST			OFFSETOF(txppr_t, b40in80_1x1ofdm)
+#define WL_TX_POWER_40UUL_S1x1_FIRST			OFFSETOF(txppr_t, b40in80_1x1mcs0)
+
+#define WL_TX_POWER_CCK_40UU_DUMMY_CDD_S1x2_FIRST OFFSETOF(txppr_t, b40in80_dummy1x2dsss)
+#define WL_TX_POWER_40UUL_OFDM_CDD_FIRST		OFFSETOF(txppr_t, b40in80_1x2cdd_ofdm)
+#define WL_TX_POWER_40UUL_S1x2_FIRST			OFFSETOF(txppr_t, b40in80_1x2cdd_mcs0)
+#define WL_TX_POWER_40UUL_STBC_S2x2_FIRST		OFFSETOF(txppr_t, b40in80_2x2stbc_mcs0)
+#define WL_TX_POWER_40UUL_S2x2_FIRST			OFFSETOF(txppr_t, b40in80_2x2sdm_mcs8)
+
+#define WL_TX_POWER_CCK_40UU_DUMMY_CDD_S1x3_FIRST OFFSETOF(txppr_t, b40in80_dummy1x3dsss)
+#define WL_TX_POWER_40UUL_OFDM_CDD_S1x3_FIRST	OFFSETOF(txppr_t, b40in80_1x3cdd_ofdm)
+#define WL_TX_POWER_40UUL_S1x3_FIRST			OFFSETOF(txppr_t, b40in80_1x3cdd_mcs0)
+#define WL_TX_POWER_40UUL_STBC_S2x3_FIRST		OFFSETOF(txppr_t, b40in80_2x3stbc_mcs0)
+#define WL_TX_POWER_40UUL_S2x3_FIRST			OFFSETOF(txppr_t, b40in80_2x3sdm_mcs8)
+#define WL_TX_POWER_40UUL_S3x3_FIRST			OFFSETOF(txppr_t, b40in80_3x3sdm_mcs16)
+
+#define WL_TX_POWER_40UUL_S1X1_VHT			OFFSETOF(txppr_t, b40in80_1x1vht)
+#define WL_TX_POWER_40UUL_S1X2_CDD_VHT		OFFSETOF(txppr_t, b40in80_1x2cdd_vht)
+#define WL_TX_POWER_40UUL_S2X2_STBC_VHT		OFFSETOF(txppr_t, b40in80_2x2stbc_vht)
+#define WL_TX_POWER_40UUL_S2X2_VHT			OFFSETOF(txppr_t, b40in80_2x2sdm_vht)
+#define WL_TX_POWER_40UUL_S1X3_CDD_VHT		OFFSETOF(txppr_t, b40in80_1x3cdd_vht)
+#define WL_TX_POWER_40UUL_S2X3_STBC_VHT		OFFSETOF(txppr_t, b40in80_2x3stbc_vht)
+#define WL_TX_POWER_40UUL_S2X3_VHT			OFFSETOF(txppr_t, b40in80_2x3sdm_vht)
+#define WL_TX_POWER_40UUL_S3X3_VHT			OFFSETOF(txppr_t, b40in80_3x3sdm_vht)
+
+#define WL_TX_POWER_MCS_32			OFFSETOF(txppr_t, mcs32) /* C_CHECK remove later */
+
+#define WL_TX_POWER_RATES			sizeof(struct txppr)
+
+/* sslpnphy specifics */
+#define WL_TX_POWER_MCS20_SISO_FIRST_SSN	WL_TX_POWER_MCS20_SISO_FIRST
+#define WL_TX_POWER_MCS40_SISO_FIRST_SSN	WL_TX_POWER_MCS40_SISO_FIRST
 
+typedef struct {
+	uint16 ver;				/* version of this struct */
+	uint16 len;				/* length in bytes of this structure */
+	uint32 flags;
+	chanspec_t chanspec;			/* txpwr report for this channel */
+	chanspec_t local_chanspec;		/* channel on which we are associated */
+	uint32 buflen;				/* ppr buffer length */
+	uint8      pprbuf[1];			/* Latest target power buffer */
+} wl_txppr_t;
+
+#define WL_TXPPR_VERSION	0
+#define WL_TXPPR_LENGTH	(sizeof(wl_txppr_t))
+#define TX_POWER_T_VERSION	44
+
+/* Defines used with channel_bandwidth for curpower */
+#define WL_BW_20MHZ 		0
+#define WL_BW_40MHZ 		1
+#define WL_BW_80MHZ 		2
+#define WL_BW_160MHZ 		3
+
+/* tx_power_t.flags bits */
+/* use for defined PPR_API */
+#define WL_TX_POWER_F_ENABLED	1
+#define WL_TX_POWER_F_HW		2
+#define WL_TX_POWER_F_MIMO		4
+#define WL_TX_POWER_F_SISO		8
+#define WL_TX_POWER_F_HT		0x10
+#define WL_TX_POWER_F_VHT		0x20
 
-#define WL_WDS_WPA_ROLE_AUTH    0
-#define WL_WDS_WPA_ROLE_SUP 1
-#define WL_WDS_WPA_ROLE_AUTO    255
+typedef struct {
+	uint32 flags;
+	chanspec_t chanspec;			/* txpwr report for this channel */
+	chanspec_t local_chanspec;		/* channel on which we are associated */
+	uint8 local_max;			/* local max according to the AP */
+	uint8 local_constraint;			/* local constraint according to the AP */
+	int8  antgain[2];			/* Ant gain for each band - from SROM */
+	uint8 rf_cores;				/* count of RF Cores being reported */
+	uint8 est_Pout[4];			/* Latest tx power out estimate per RF chain */
+	uint8 est_Pout_act[4]; /* Latest tx power out estimate per RF chain w/o adjustment */
+	uint8 est_Pout_cck;			/* Latest CCK tx power out estimate */
+	uint8 tx_power_max[4];		/* Maximum target power among all rates */
+	uint tx_power_max_rate_ind[4];		/* Index of the rate with the max target power */
+	uint8 user_limit[WL_TX_POWER_RATES];	/* User limit */
+	int8 board_limit[WL_TX_POWER_RATES];	/* Max power board can support (SROM) */
+	int8 target[WL_TX_POWER_RATES];			/* Latest target power */
+	int8 clm_limits[WL_NUMRATES];		/* regulatory limits - 20, 40 or 80MHz */
+	int8 clm_limits_subchan1[WL_NUMRATES];	/* regulatory limits - 20in40 or 40in80 */
+	int8 clm_limits_subchan2[WL_NUMRATES];	/* regulatory limits - 20in80MHz */
+	int8 sar;					/* SAR limit for display by wl executable */
+	int8 channel_bandwidth;		/* 20, 40 or 80 MHz bandwidth? */
+	uint8 version;				/* Version of the data format wlu <--> driver */
+	uint8 display_core;			/* Displayed curpower core */
+	int8 target_offsets[4];		/* Target power offsets for current rate per core */
+	uint32 last_tx_ratespec;	/* Ratespec for last transmition */
+	int8 SARLIMIT[MAX_STREAMS_SUPPORTED];
+} tx_power_t;
+
+typedef struct tx_inst_power {
+	uint8 txpwr_est_Pout[2];			/* Latest estimate for 2.4 and 5 Ghz */
+	uint8 txpwr_est_Pout_gofdm;			/* Pwr estimate for 2.4 OFDM */
+} tx_inst_power_t;
 
 
-#define WL_EVENTING_MASK_LEN    16
+typedef struct {
+	uint32 flags;
+	chanspec_t chanspec;			/* txpwr report for this channel */
+	chanspec_t local_chanspec;		/* channel on which we are associated */
+	uint8 local_max;			/* local max according to the AP */
+	uint8 local_constraint;			/* local constraint according to the AP */
+	int8  antgain[2];			/* Ant gain for each band - from SROM */
+	uint8 rf_cores;				/* count of RF Cores being reported */
+	uint8 est_Pout[4];			/* Latest tx power out estimate per RF chain */
+	uint8 est_Pout_act[4];                  /* Latest tx power out estimate per RF chain
+						 * without adjustment
+						 */
+	uint8 est_Pout_cck;			/* Latest CCK tx power out estimate */
+	uint8 tx_power_max[4];                  /* Maximum target power among all rates */
+	uint tx_power_max_rate_ind[4];         /* Index of the rate with the max target power */
+	txppr_t user_limit;			/* User limit */
+	txppr_t reg_limit;			/* Regulatory power limit */
+	txppr_t board_limit;			/* Max power board can support (SROM) */
+	txppr_t target;				/* Latest target power */
+} wl_txpwr_t;
+
+#define WL_NUM_TXCHAIN_MAX	4
+typedef struct wl_txchain_pwr_offsets {
+	int8 offset[WL_NUM_TXCHAIN_MAX];	/* quarter dBm signed offset for each chain */
+} wl_txchain_pwr_offsets_t;
+
+/* 802.11h measurement types */
+#define WLC_MEASURE_TPC			1
+#define WLC_MEASURE_CHANNEL_BASIC	2
+#define WLC_MEASURE_CHANNEL_CCA		3
+#define WLC_MEASURE_CHANNEL_RPI		4
+
+/* regulatory enforcement levels */
+#define SPECT_MNGMT_OFF			0		/* both 11h and 11d disabled */
+#define SPECT_MNGMT_LOOSE_11H		1		/* allow non-11h APs in scan lists */
+#define SPECT_MNGMT_STRICT_11H		2		/* prune out non-11h APs from scan list */
+#define SPECT_MNGMT_STRICT_11D		3		/* switch to 802.11D mode */
+/* SPECT_MNGMT_LOOSE_11H_D - same as SPECT_MNGMT_LOOSE with the exception that Country IE
+ * adoption is done regardless of capability spectrum_management
+ */
+#define SPECT_MNGMT_LOOSE_11H_D		4		/* operation defined above */
+
+#define WL_CHAN_VALID_HW	(1 << 0)	/* valid with current HW */
+#define WL_CHAN_VALID_SW	(1 << 1)	/* valid with current country setting */
+#define WL_CHAN_BAND_5G		(1 << 2)	/* 5GHz-band channel */
+#define WL_CHAN_RADAR		(1 << 3)	/* radar sensitive  channel */
+#define WL_CHAN_INACTIVE	(1 << 4)	/* temporarily inactive due to radar */
+#define WL_CHAN_PASSIVE		(1 << 5)	/* channel is in passive mode */
+#define WL_CHAN_RESTRICTED	(1 << 6)	/* restricted use channel */
+
+/* BTC mode used by "btc_mode" iovar */
+#define	WL_BTC_DISABLE		0	/* disable BT coexistence */
+#define WL_BTC_FULLTDM      1	/* full TDM COEX */
+#define WL_BTC_ENABLE       1	/* full TDM COEX to maintain backward compatiblity */
+#define WL_BTC_PREMPT      2    /* full TDM COEX with preemption */
+#define WL_BTC_LITE        3	/* light weight coex for large isolation platform */
+#define WL_BTC_PARALLEL		4   /* BT and WLAN run in parallel with separate antenna  */
+#define WL_BTC_HYBRID		5   /* hybrid coex, only ack is allowed to transmit in BT slot */
+#define WL_BTC_DEFAULT		8	/* set the default mode for the device */
+#define WL_INF_BTC_DISABLE      0
+#define WL_INF_BTC_ENABLE       1
+#define WL_INF_BTC_AUTO         3
+
+/* BTC wire used by "btc_wire" iovar */
+#define	WL_BTC_DEFWIRE		0	/* use default wire setting */
+#define WL_BTC_2WIRE		2	/* use 2-wire BTC */
+#define WL_BTC_3WIRE		3	/* use 3-wire BTC */
+#define WL_BTC_4WIRE		4	/* use 4-wire BTC */
+
+/* BTC flags: BTC configuration that can be set by host */
+#define WL_BTC_FLAG_PREMPT               (1 << 0)
+#define WL_BTC_FLAG_BT_DEF               (1 << 1)
+#define WL_BTC_FLAG_ACTIVE_PROT          (1 << 2)
+#define WL_BTC_FLAG_SIM_RSP              (1 << 3)
+#define WL_BTC_FLAG_PS_PROTECT           (1 << 4)
+#define WL_BTC_FLAG_SIM_TX_LP	         (1 << 5)
+#define WL_BTC_FLAG_ECI                  (1 << 6)
+#define WL_BTC_FLAG_LIGHT                (1 << 7)
+#define WL_BTC_FLAG_PARALLEL             (1 << 8)
+
+/* Message levels */
+#define WL_ERROR_VAL		0x00000001
+#define WL_TRACE_VAL		0x00000002
+#define WL_PRHDRS_VAL		0x00000004
+#define WL_PRPKT_VAL		0x00000008
+#define WL_INFORM_VAL		0x00000010
+#define WL_TMP_VAL		0x00000020
+#define WL_OID_VAL		0x00000040
+#define WL_RATE_VAL		0x00000080
+#define WL_ASSOC_VAL		0x00000100
+#define WL_PRUSR_VAL		0x00000200
+#define WL_PS_VAL		0x00000400
+#define WL_TXPWR_VAL		0x00000800	/* retired in TOT on 6/10/2009 */
+#define WL_PORT_VAL		0x00001000
+#define WL_DUAL_VAL		0x00002000
+#define WL_WSEC_VAL		0x00004000
+#define WL_WSEC_DUMP_VAL	0x00008000
+#define WL_LOG_VAL		0x00010000
+#define WL_NRSSI_VAL		0x00020000	/* retired in TOT on 6/10/2009 */
+#define WL_LOFT_VAL		0x00040000	/* retired in TOT on 6/10/2009 */
+#define WL_REGULATORY_VAL	0x00080000
+#define WL_PHYCAL_VAL		0x00100000	/* retired in TOT on 6/10/2009 */
+#define WL_RADAR_VAL		0x00200000	/* retired in TOT on 6/10/2009 */
+#define WL_MPC_VAL		0x00400000
+#define WL_APSTA_VAL		0x00800000
+#define WL_DFS_VAL		0x01000000
+#define WL_BA_VAL		0x02000000	/* retired in TOT on 6/14/2010 */
+#define WL_ACI_VAL		0x04000000
+#define WL_MBSS_VAL		0x04000000
+#define WL_CAC_VAL		0x08000000
+#define WL_AMSDU_VAL		0x10000000
+#define WL_AMPDU_VAL		0x20000000
+#define WL_FFPLD_VAL		0x40000000
+
+/* wl_msg_level is full. For new bits take the next one and AND with
+ * wl_msg_level2 in wl_dbg.h
+ */
+#define WL_DPT_VAL 		0x00000001
+#define WL_SCAN_VAL		0x00000002
+#define WL_WOWL_VAL		0x00000004
+#define WL_COEX_VAL		0x00000008
+#define WL_RTDC_VAL		0x00000010
+#define WL_PROTO_VAL		0x00000020
+#define WL_BTA_VAL		0x00000040
+#define WL_CHANINT_VAL		0x00000080
+#define WL_THERMAL_VAL		0x00000100	/* retired in TOT on 6/10/2009 */
+#define WL_P2P_VAL		0x00000200
+#define WL_ITFR_VAL		0x00000400
+#define WL_MCHAN_VAL		0x00000800
+#define WL_TDLS_VAL		0x00001000
+#define WL_MCNX_VAL		0x00002000
+#define WL_PROT_VAL		0x00004000
+#define WL_PSTA_VAL		0x00008000
+#define WL_TBTT_VAL		0x00010000
+#define WL_NIC_VAL		0x00020000
+#define WL_PWRSEL_VAL		0x00040000
+#define WL_TRF_MGMT_VAL		0x00080000
+#define WL_L2FILTER_VAL		0x00100000
+#define WL_TSO_VAL		0x00200000
+#define WL_MQ_VAL		0x00400000
+/* These 3 levels are currently not used in trunk but in Aardvark and Phoenix2 with != values */
+#define WL_LPC_VAL	        0x00800000
+#define WL_TXBF_VAL		0x01000000
+#define WL_P2PO_VAL		0x02000000
+/* This level is synchronized with other branches */
+#define WL_WNM_VAL		0x04000000
+/* This level is currently not used in trunk but used in Phoenix2 */
+#define WL_SRSCAN_VAL	0x08000000
+
+/* use top-bit for WL_TIME_STAMP_VAL because this is a modifier
+ * rather than a message-type of its own
+ */
+#define WL_TIMESTAMP_VAL        0x80000000
+
+/* max # of leds supported by GPIO (gpio pin# == led index#) */
+#define	WL_LED_NUMGPIO		32	/* gpio 0-31 */
+
+/* led per-pin behaviors */
+#define	WL_LED_OFF		0		/* always off */
+#define	WL_LED_ON		1		/* always on */
+#define	WL_LED_ACTIVITY		2		/* activity */
+#define	WL_LED_RADIO		3		/* radio enabled */
+#define	WL_LED_ARADIO		4		/* 5  Ghz radio enabled */
+#define	WL_LED_BRADIO		5		/* 2.4Ghz radio enabled */
+#define	WL_LED_BGMODE		6		/* on if gmode, off if bmode */
+#define	WL_LED_WI1		7
+#define	WL_LED_WI2		8
+#define	WL_LED_WI3		9
+#define	WL_LED_ASSOC		10		/* associated state indicator */
+#define	WL_LED_INACTIVE		11		/* null behavior (clears default behavior) */
+#define	WL_LED_ASSOCACT		12		/* on when associated; blink fast for activity */
+#define WL_LED_WI4		13
+#define WL_LED_WI5		14
+#define	WL_LED_BLINKSLOW	15		/* blink slow */
+#define	WL_LED_BLINKMED		16		/* blink med */
+#define	WL_LED_BLINKFAST	17		/* blink fast */
+#define	WL_LED_BLINKCUSTOM	18		/* blink custom */
+#define	WL_LED_BLINKPERIODIC	19		/* blink periodic (custom 1000ms / off 400ms) */
+#define WL_LED_ASSOC_WITH_SEC 	20		/* when connected with security */
+						/* keep on for 300 sec */
+#define WL_LED_START_OFF 	21		/* off upon boot, could be turned on later */
+#define WL_LED_W6		22		/* off upon boot, could be turned on later */
+#define WL_LED_WI7		23		/* off upon boot, could be turned on later */
+#define	WL_LED_NUMBEHAVIOR	24
+
+/* led behavior numeric value format */
+#define	WL_LED_BEH_MASK		0x7f		/* behavior mask */
+#define	WL_LED_AL_MASK		0x80		/* activelow (polarity) bit */
+
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS		64
+
+/* max number of chanspecs (used by the iovar to calc. buf space) */
+#define WL_NUMCHANSPECS 110
+
+/* WDS link local endpoint WPA role */
+#define WL_WDS_WPA_ROLE_AUTH	0	/* authenticator */
+#define WL_WDS_WPA_ROLE_SUP	1	/* supplicant */
+#define WL_WDS_WPA_ROLE_AUTO	255	/* auto, based on mac addr value */
+
+/* number of bytes needed to define a 128-bit mask for MAC event reporting */
+#define WL_EVENTING_MASK_LEN	16
 
+/*
+ * Join preference iovar value is an array of tuples. Each tuple has a one-byte type,
+ * a one-byte length, and a variable length value.  RSSI type tuple must be present
+ * in the array.
+ *
+ * Types are defined in "join preference types" section.
+ *
+ * Length is the value size in octets. It is reserved for WL_JOIN_PREF_WPA type tuple
+ * and must be set to zero.
+ *
+ * Values are defined below.
+ *
+ * 1. RSSI - 2 octets
+ * offset 0: reserved
+ * offset 1: reserved
+ *
+ * 2. WPA - 2 + 12 * n octets (n is # tuples defined below)
+ * offset 0: reserved
+ * offset 1: # of tuples
+ * offset 2: tuple 1
+ * offset 14: tuple 2
+ * ...
+ * offset 2 + 12 * (n - 1) octets: tuple n
+ *
+ * struct wpa_cfg_tuple {
+ *   uint8 akm[DOT11_OUI_LEN+1];     akm suite
+ *   uint8 ucipher[DOT11_OUI_LEN+1]; unicast cipher suite
+ *   uint8 mcipher[DOT11_OUI_LEN+1]; multicast cipher suite
+ * };
+ *
+ * multicast cipher suite can be specified as a specific cipher suite or WL_WPA_ACP_MCS_ANY.
+ *
+ * 3. BAND - 2 octets
+ * offset 0: reserved
+ * offset 1: see "band preference" and "band types"
+ *
+ * 4. BAND RSSI - 2 octets
+ * offset 0: band types
+ * offset 1: +ve RSSI boost value in dB
+ */
 
+/* join preference types */
+#define WL_JOIN_PREF_RSSI	1	/* by RSSI */
+#define WL_JOIN_PREF_WPA	2	/* by akm and ciphers */
+#define WL_JOIN_PREF_BAND	3	/* by 802.11 band */
+#define WL_JOIN_PREF_RSSI_DELTA	4	/* by 802.11 band only if RSSI delta condition matches */
+#define WL_JOIN_PREF_TRANS_PREF	5	/* defined by requesting AP */
 
+/* band preference */
+#define WLJP_BAND_ASSOC_PREF	255	/* use what WLC_SET_ASSOC_PREFER ioctl specifies */
 
-#define WL_JOIN_PREF_RSSI   1
-#define WL_JOIN_PREF_WPA    2
-#define WL_JOIN_PREF_BAND   3
-#define WL_JOIN_PREF_RSSI_DELTA 4
-
-
-#define WLJP_BAND_ASSOC_PREF    255
-
-
-#define WL_WPA_ACP_MCS_ANY  "\x00\x00\x00\x00"
+/* any multicast cipher suite */
+#define WL_WPA_ACP_MCS_ANY	"\x00\x00\x00\x00"
 
 struct tsinfo_arg {
 	uint8 octets[3];
 };
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
-#define NFIFO           6
+#define	NFIFO			6	/* # tx/rx fifopairs */
 
-#define WL_CNT_T_VERSION    6
+#define	WL_CNT_T_VERSION	8	/* current version of wl_cnt_t struct */
 
 typedef struct {
-	uint16  version;
-	uint16  length;
-
-
-	uint32  txframe;
-	uint32  txbyte;
-	uint32  txretrans;
-	uint32  txerror;
-	uint32  txctl;
-	uint32  txprshort;
-	uint32  txserr;
-	uint32  txnobuf;
-	uint32  txnoassoc;
-	uint32  txrunt;
-	uint32  txchit;
-	uint32  txcmiss;
-
-
-	uint32  txuflo;
-	uint32  txphyerr;
-	uint32  txphycrs;
+	uint16	version;	/* see definition of WL_CNT_T_VERSION */
+	uint16	length;		/* length of entire structure */
+
+	/* transmit stat counters */
+	uint32	txframe;	/* tx data frames */
+	uint32	txbyte;		/* tx data bytes */
+	uint32	txretrans;	/* tx mac retransmits */
+	uint32	txerror;	/* tx data errors (derived: sum of others) */
+	uint32	txctl;		/* tx management frames */
+	uint32	txprshort;	/* tx short preamble frames */
+	uint32	txserr;		/* tx status errors */
+	uint32	txnobuf;	/* tx out of buffers errors */
+	uint32	txnoassoc;	/* tx discard because we're not associated */
+	uint32	txrunt;		/* tx runt frames */
+	uint32	txchit;		/* tx header cache hit (fastpath) */
+	uint32	txcmiss;	/* tx header cache miss (slowpath) */
+
+	/* transmit chip error counters */
+	uint32	txuflo;		/* tx fifo underflows */
+	uint32	txphyerr;	/* tx phy errors (indicated in tx status) */
+	uint32	txphycrs;
+
+	/* receive stat counters */
+	uint32	rxframe;	/* rx data frames */
+	uint32	rxbyte;		/* rx data bytes */
+	uint32	rxerror;	/* rx data errors (derived: sum of others) */
+	uint32	rxctl;		/* rx management frames */
+	uint32	rxnobuf;	/* rx out of buffers errors */
+	uint32	rxnondata;	/* rx non data frames in the data channel errors */
+	uint32	rxbadds;	/* rx bad DS errors */
+	uint32	rxbadcm;	/* rx bad control or management frames */
+	uint32	rxfragerr;	/* rx fragmentation errors */
+	uint32	rxrunt;		/* rx runt frames */
+	uint32	rxgiant;	/* rx giant frames */
+	uint32	rxnoscb;	/* rx no scb error */
+	uint32	rxbadproto;	/* rx invalid frames */
+	uint32	rxbadsrcmac;	/* rx frames with Invalid Src Mac */
+	uint32	rxbadda;	/* rx frames tossed for invalid da */
+	uint32	rxfilter;	/* rx frames filtered out */
+
+	/* receive chip error counters */
+	uint32	rxoflo;		/* rx fifo overflow errors */
+	uint32	rxuflo[NFIFO];	/* rx dma descriptor underflow errors */
+
+	uint32	d11cnt_txrts_off;	/* d11cnt txrts value when reset d11cnt */
+	uint32	d11cnt_rxcrc_off;	/* d11cnt rxcrc value when reset d11cnt */
+	uint32	d11cnt_txnocts_off;	/* d11cnt txnocts value when reset d11cnt */
+
+	/* misc counters */
+	uint32	dmade;		/* tx/rx dma descriptor errors */
+	uint32	dmada;		/* tx/rx dma data errors */
+	uint32	dmape;		/* tx/rx dma descriptor protocol errors */
+	uint32	reset;		/* reset count */
+	uint32	tbtt;		/* cnts the TBTT int's */
+	uint32	txdmawar;
+	uint32	pkt_callback_reg_fail;	/* callbacks register failure */
+
+	/* MAC counters: 32-bit version of d11.h's macstat_t */
+	uint32	txallfrm;	/* total number of frames sent, incl. Data, ACK, RTS, CTS,
+				 * Control Management (includes retransmissions)
+				 */
+	uint32	txrtsfrm;	/* number of RTS sent out by the MAC */
+	uint32	txctsfrm;	/* number of CTS sent out by the MAC */
+	uint32	txackfrm;	/* number of ACK frames sent out */
+	uint32	txdnlfrm;	/* Not used */
+	uint32	txbcnfrm;	/* beacons transmitted */
+	uint32	txfunfl[8];	/* per-fifo tx underflows */
+	uint32	txtplunfl;	/* Template underflows (mac was too slow to transmit ACK/CTS
+				 * or BCN)
+				 */
+	uint32	txphyerror;	/* Transmit phy error, type of error is reported in tx-status for
+				 * driver enqueued frames
+				 */
+	uint32	rxfrmtoolong;	/* Received frame longer than legal limit (2346 bytes) */
+	uint32	rxfrmtooshrt;	/* Received frame did not contain enough bytes for its frame type */
+	uint32	rxinvmachdr;	/* Either the protocol version != 0 or frame type not
+				 * data/control/management
+				 */
+	uint32	rxbadfcs;	/* number of frames for which the CRC check failed in the MAC */
+	uint32	rxbadplcp;	/* parity check of the PLCP header failed */
+	uint32	rxcrsglitch;	/* PHY was able to correlate the preamble but not the header */
+	uint32	rxstrt;		/* Number of received frames with a good PLCP
+				 * (i.e. passing parity check)
+				 */
+	uint32	rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+	uint32	rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+	uint32	rxcfrmucast;	/* number of received CNTRL frames with good FCS and matching RA */
+	uint32	rxrtsucast;	/* number of unicast RTS addressed to the MAC (good FCS) */
+	uint32	rxctsucast;	/* number of unicast CTS addressed to the MAC (good FCS) */
+	uint32	rxackucast;	/* number of ucast ACKS received (good FCS) */
+	uint32	rxdfrmocast;	/* number of received DATA frames (good FCS and not matching RA) */
+	uint32	rxmfrmocast;	/* number of received MGMT frames (good FCS and not matching RA) */
+	uint32	rxcfrmocast;	/* number of received CNTRL frame (good FCS and not matching RA) */
+	uint32	rxrtsocast;	/* number of received RTS not addressed to the MAC */
+	uint32	rxctsocast;	/* number of received CTS not addressed to the MAC */
+	uint32	rxdfrmmcast;	/* number of RX Data multicast frames received by the MAC */
+	uint32	rxmfrmmcast;	/* number of RX Management multicast frames received by the MAC */
+	uint32	rxcfrmmcast;	/* number of RX Control multicast frames received by the MAC
+				 * (unlikely to see these)
+				 */
+	uint32	rxbeaconmbss;	/* beacons received from member of BSS */
+	uint32	rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+				  * other BSS (WDS FRAME)
+				  */
+	uint32	rxbeaconobss;	/* beacons received from other BSS */
+	uint32	rxrsptmout;	/* Number of response timeouts for transmitted frames
+				 * expecting a response
+				 */
+	uint32	bcntxcancl;	/* transmit beacons canceled due to receipt of beacon (IBSS) */
+	uint32	rxf0ovfl;	/* Number of receive fifo 0 overflows */
+	uint32	rxf1ovfl;	/* Number of receive fifo 1 overflows (obsolete) */
+	uint32	rxf2ovfl;	/* Number of receive fifo 2 overflows (obsolete) */
+	uint32	txsfovfl;	/* Number of transmit status fifo overflows (obsolete) */
+	uint32	pmqovfl;	/* Number of PMQ overflows */
+	uint32	rxcgprqfrm;	/* Number of received Probe requests that made it into
+				 * the PRQ fifo
+				 */
+	uint32	rxcgprsqovfl;	/* Rx Probe Request Que overflow in the AP */
+	uint32	txcgprsfail;	/* Tx Probe Response Fail. AP sent probe response but did
+				 * not get ACK
+				 */
+	uint32	txcgprssuc;	/* Tx Probe Response Success (ACK was received) */
+	uint32	prs_timeout;	/* Number of probe requests that were dropped from the PRQ
+				 * fifo because a probe response could not be sent out within
+				 * the time limit defined in M_PRS_MAXTIME
+				 */
+	uint32	rxnack;		/* obsolete */
+	uint32	frmscons;	/* obsolete */
+	uint32	txnack;		/* obsolete */
+	uint32	txglitch_nack;	/* obsolete */
+	uint32	txburst;	/* obsolete */
+
+	/* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+	uint32	txfrag;		/* dot11TransmittedFragmentCount */
+	uint32	txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32	txfail;		/* dot11FailedCount */
+	uint32	txretry;	/* dot11RetryCount */
+	uint32	txretrie;	/* dot11MultipleRetryCount */
+	uint32	rxdup;		/* dot11FrameduplicateCount */
+	uint32	txrts;		/* dot11RTSSuccessCount */
+	uint32	txnocts;	/* dot11RTSFailureCount */
+	uint32	txnoack;	/* dot11ACKFailureCount */
+	uint32	rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32	rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32	rxcrc;		/* dot11FCSErrorCount */
+	uint32	txfrmsnt;	/* dot11TransmittedFrameCount (bogus MIB?) */
+	uint32	rxundec;	/* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32	tkipmicfaill;	/* TKIPLocalMICFailures */
+	uint32	tkipcntrmsr;	/* TKIPCounterMeasuresInvoked */
+	uint32	tkipreplay;	/* TKIPReplays */
+	uint32	ccmpfmterr;	/* CCMPFormatErrors */
+	uint32	ccmpreplay;	/* CCMPReplays */
+	uint32	ccmpundec;	/* CCMPDecryptErrors */
+	uint32	fourwayfail;	/* FourWayHandshakeFailures */
+	uint32	wepundec;	/* dot11WEPUndecryptableCount */
+	uint32	wepicverr;	/* dot11WEPICVErrorCount */
+	uint32	decsuccess;	/* DecryptSuccessCount */
+	uint32	tkipicverr;	/* TKIPICVErrorCount */
+	uint32	wepexcluded;	/* dot11WEPExcludedCount */
+
+	uint32	txchanrej;	/* Tx frames suppressed due to channel rejection */
+	uint32	psmwds;		/* Count PSM watchdogs */
+	uint32	phywatchdog;	/* Count Phy watchdogs (triggered by ucode) */
+
+	/* MBSS counters, AP only */
+	uint32	prq_entries_handled;	/* PRQ entries read in */
+	uint32	prq_undirected_entries;	/*    which were bcast bss & ssid */
+	uint32	prq_bad_entries;	/*    which could not be translated to info */
+	uint32	atim_suppress_count;	/* TX suppressions on ATIM fifo */
+	uint32	bcn_template_not_ready;	/* Template marked in use on send bcn ... */
+	uint32	bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+	uint32	late_tbtt_dpc;	/* TBTT DPC did not happen in time */
+
+	/* per-rate receive stat counters */
+	uint32  rx1mbps;	/* packets rx at 1Mbps */
+	uint32  rx2mbps;	/* packets rx at 2Mbps */
+	uint32  rx5mbps5;	/* packets rx at 5.5Mbps */
+	uint32  rx6mbps;	/* packets rx at 6Mbps */
+	uint32  rx9mbps;	/* packets rx at 9Mbps */
+	uint32  rx11mbps;	/* packets rx at 11Mbps */
+	uint32  rx12mbps;	/* packets rx at 12Mbps */
+	uint32  rx18mbps;	/* packets rx at 18Mbps */
+	uint32  rx24mbps;	/* packets rx at 24Mbps */
+	uint32  rx36mbps;	/* packets rx at 36Mbps */
+	uint32  rx48mbps;	/* packets rx at 48Mbps */
+	uint32  rx54mbps;	/* packets rx at 54Mbps */
+	uint32  rx108mbps; 	/* packets rx at 108mbps */
+	uint32  rx162mbps;	/* packets rx at 162mbps */
+	uint32  rx216mbps;	/* packets rx at 216 mbps */
+	uint32  rx270mbps;	/* packets rx at 270 mbps */
+	uint32  rx324mbps;	/* packets rx at 324 mbps */
+	uint32  rx378mbps;	/* packets rx at 378 mbps */
+	uint32  rx432mbps;	/* packets rx at 432 mbps */
+	uint32  rx486mbps;	/* packets rx at 486 mbps */
+	uint32  rx540mbps;	/* packets rx at 540 mbps */
+
+	/* pkteng rx frame stats */
+	uint32	pktengrxducast; /* unicast frames rxed by the pkteng code */
+	uint32	pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+	uint32	rfdisable;	/* count of radio disables */
+	uint32	bphy_rxcrsglitch;	/* PHY count of bphy glitches */
+
+	uint32	txexptime;	/* Tx frames suppressed due to timer expiration */
+
+	uint32	txmpdu_sgi;	/* count for sgi transmit */
+	uint32	rxmpdu_sgi;	/* count for sgi received */
+	uint32	txmpdu_stbc;	/* count for stbc transmit */
+	uint32	rxmpdu_stbc;	/* count for stbc received */
+
+	uint32	rxundec_mcst;	/* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32	tkipmicfaill_mcst;	/* TKIPLocalMICFailures */
+	uint32	tkipcntrmsr_mcst;	/* TKIPCounterMeasuresInvoked */
+	uint32	tkipreplay_mcst;	/* TKIPReplays */
+	uint32	ccmpfmterr_mcst;	/* CCMPFormatErrors */
+	uint32	ccmpreplay_mcst;	/* CCMPReplays */
+	uint32	ccmpundec_mcst;	/* CCMPDecryptErrors */
+	uint32	fourwayfail_mcst;	/* FourWayHandshakeFailures */
+	uint32	wepundec_mcst;	/* dot11WEPUndecryptableCount */
+	uint32	wepicverr_mcst;	/* dot11WEPICVErrorCount */
+	uint32	decsuccess_mcst;	/* DecryptSuccessCount */
+	uint32	tkipicverr_mcst;	/* TKIPICVErrorCount */
+	uint32	wepexcluded_mcst;	/* dot11WEPExcludedCount */
+
+	uint32	dma_hang;	/* count for dma hang */
+	uint32	reinit;		/* count for reinit */
+
+	uint32  pstatxucast;	/* count of ucast frames xmitted on all psta assoc */
+	uint32  pstatxnoassoc;	/* count of txnoassoc frames xmitted on all psta assoc */
+	uint32  pstarxucast;	/* count of ucast frames received on all psta assoc */
+	uint32  pstarxbcmc;	/* count of bcmc frames received on all psta */
+	uint32  pstatxbcmc;	/* count of bcmc frames transmitted on all psta */
+
+	uint32  cso_passthrough; /* hw cso required but passthrough */
+	uint32	chained;	/* number of frames chained */
+	uint32	chainedsz1;	/* number of chain size 1 frames */
+	uint32	unchained;	/* number of frames not chained */
+	uint32	maxchainsz;	/* max chain size so far */
+	uint32	currchainsz;	/* current chain size */
+	uint32 	cso_normal;	/* hw cso hdr for normal process */
+} wl_cnt_t;
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+typedef struct {
+	uint16  version;    /* see definition of WL_CNT_T_VERSION */
+	uint16  length;     /* length of entire structure */
+
+	/* transmit stat counters */
+	uint32  txframe;    /* tx data frames */
+	uint32  txbyte;     /* tx data bytes */
+	uint32  txretrans;  /* tx mac retransmits */
+	uint32  txerror;    /* tx data errors (derived: sum of others) */
+	uint32  txctl;      /* tx management frames */
+	uint32  txprshort;  /* tx short preamble frames */
+	uint32  txserr;     /* tx status errors */
+	uint32  txnobuf;    /* tx out of buffers errors */
+	uint32  txnoassoc;  /* tx discard because we're not associated */
+	uint32  txrunt;     /* tx runt frames */
+	uint32  txchit;     /* tx header cache hit (fastpath) */
+	uint32  txcmiss;    /* tx header cache miss (slowpath) */
+
+	/* transmit chip error counters */
+	uint32  txuflo;     /* tx fifo underflows */
+	uint32  txphyerr;   /* tx phy errors (indicated in tx status) */
+	uint32  txphycrs;
 
-	uint32  rxframe;
-	uint32  rxbyte;
-	uint32  rxerror;
-	uint32  rxctl;
-	uint32  rxnobuf;
-	uint32  rxnondata;
-	uint32  rxbadds;
-	uint32  rxbadcm;
-	uint32  rxfragerr;
-	uint32  rxrunt;
-	uint32  rxgiant;
-	uint32  rxnoscb;
-	uint32  rxbadproto;
-	uint32  rxbadsrcmac;
-	uint32  rxbadda;
-	uint32  rxfilter;
-
-
-	uint32  rxoflo;
-	uint32  rxuflo[NFIFO];
-
-	uint32  d11cnt_txrts_off;
-	uint32  d11cnt_rxcrc_off;
-	uint32  d11cnt_txnocts_off;
-
-
-	uint32  dmade;
-	uint32  dmada;
-	uint32  dmape;
-	uint32  reset;
-	uint32  tbtt;
+	/* receive stat counters */
+	uint32  rxframe;    /* rx data frames */
+	uint32  rxbyte;     /* rx data bytes */
+	uint32  rxerror;    /* rx data errors (derived: sum of others) */
+	uint32  rxctl;      /* rx management frames */
+	uint32  rxnobuf;    /* rx out of buffers errors */
+	uint32  rxnondata;  /* rx non data frames in the data channel errors */
+	uint32  rxbadds;    /* rx bad DS errors */
+	uint32  rxbadcm;    /* rx bad control or management frames */
+	uint32  rxfragerr;  /* rx fragmentation errors */
+	uint32  rxrunt;     /* rx runt frames */
+	uint32  rxgiant;    /* rx giant frames */
+	uint32  rxnoscb;    /* rx no scb error */
+	uint32  rxbadproto; /* rx invalid frames */
+	uint32  rxbadsrcmac;    /* rx frames with Invalid Src Mac */
+	uint32  rxbadda;    /* rx frames tossed for invalid da */
+	uint32  rxfilter;   /* rx frames filtered out */
+
+	/* receive chip error counters */
+	uint32  rxoflo;     /* rx fifo overflow errors */
+	uint32  rxuflo[NFIFO];  /* rx dma descriptor underflow errors */
+
+	uint32  d11cnt_txrts_off;   /* d11cnt txrts value when reset d11cnt */
+	uint32  d11cnt_rxcrc_off;   /* d11cnt rxcrc value when reset d11cnt */
+	uint32  d11cnt_txnocts_off; /* d11cnt txnocts value when reset d11cnt */
+
+	/* misc counters */
+	uint32  dmade;      /* tx/rx dma descriptor errors */
+	uint32  dmada;      /* tx/rx dma data errors */
+	uint32  dmape;      /* tx/rx dma descriptor protocol errors */
+	uint32  reset;      /* reset count */
+	uint32  tbtt;       /* cnts the TBTT int's */
 	uint32  txdmawar;
-	uint32  pkt_callback_reg_fail;
-
-
-	uint32  txallfrm;
-	uint32  txrtsfrm;
-	uint32  txctsfrm;
-	uint32  txackfrm;
-	uint32  txdnlfrm;
-	uint32  txbcnfrm;
-	uint32  txfunfl[8];
-	uint32  txtplunfl;
-	uint32  txphyerror;
-	uint32  rxfrmtoolong;
-	uint32  rxfrmtooshrt;
-	uint32  rxinvmachdr;
-	uint32  rxbadfcs;
-	uint32  rxbadplcp;
-	uint32  rxcrsglitch;
-	uint32  rxstrt;
-	uint32  rxdfrmucastmbss;
-	uint32  rxmfrmucastmbss;
-	uint32  rxcfrmucast;
-	uint32  rxrtsucast;
-	uint32  rxctsucast;
-	uint32  rxackucast;
-	uint32  rxdfrmocast;
-	uint32  rxmfrmocast;
-	uint32  rxcfrmocast;
-	uint32  rxrtsocast;
-	uint32  rxctsocast;
-	uint32  rxdfrmmcast;
-	uint32  rxmfrmmcast;
-	uint32  rxcfrmmcast;
-	uint32  rxbeaconmbss;
-	uint32  rxdfrmucastobss;
-	uint32  rxbeaconobss;
-	uint32  rxrsptmout;
-	uint32  bcntxcancl;
-	uint32  rxf0ovfl;
-	uint32  rxf1ovfl;
-	uint32  rxf2ovfl;
-	uint32  txsfovfl;
-	uint32  pmqovfl;
-	uint32  rxcgprqfrm;
-	uint32  rxcgprsqovfl;
-	uint32  txcgprsfail;
-	uint32  txcgprssuc;
-	uint32  prs_timeout;
+	uint32  pkt_callback_reg_fail;  /* callbacks register failure */
+
+	/* MAC counters: 32-bit version of d11.h's macstat_t */
+	uint32  txallfrm;   /* total number of frames sent, incl. Data, ACK, RTS, CTS,
+			     * Control Management (includes retransmissions)
+			     */
+	uint32  txrtsfrm;   /* number of RTS sent out by the MAC */
+	uint32  txctsfrm;   /* number of CTS sent out by the MAC */
+	uint32  txackfrm;   /* number of ACK frames sent out */
+	uint32  txdnlfrm;   /* Not used */
+	uint32  txbcnfrm;   /* beacons transmitted */
+	uint32  txfunfl[8]; /* per-fifo tx underflows */
+	uint32  txtplunfl;  /* Template underflows (mac was too slow to transmit ACK/CTS
+			     * or BCN)
+			     */
+	uint32  txphyerror; /* Transmit phy error, type of error is reported in tx-status for
+			     * driver enqueued frames
+			     */
+	uint32  rxfrmtoolong;   /* Received frame longer than legal limit (2346 bytes) */
+	uint32  rxfrmtooshrt;   /* Received frame did not contain enough bytes for its frame type */
+	uint32  rxinvmachdr;    /* Either the protocol version != 0 or frame type not
+				 * data/control/management
+			   */
+	uint32  rxbadfcs;   /* number of frames for which the CRC check failed in the MAC */
+	uint32  rxbadplcp;  /* parity check of the PLCP header failed */
+	uint32  rxcrsglitch;    /* PHY was able to correlate the preamble but not the header */
+	uint32  rxstrt;     /* Number of received frames with a good PLCP
+			     * (i.e. passing parity check)
+			     */
+	uint32  rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+	uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+	uint32  rxcfrmucast;    /* number of received CNTRL frames with good FCS and matching RA */
+	uint32  rxrtsucast; /* number of unicast RTS addressed to the MAC (good FCS) */
+	uint32  rxctsucast; /* number of unicast CTS addressed to the MAC (good FCS) */
+	uint32  rxackucast; /* number of ucast ACKS received (good FCS) */
+	uint32  rxdfrmocast;    /* number of received DATA frames (good FCS and not matching RA) */
+	uint32  rxmfrmocast;    /* number of received MGMT frames (good FCS and not matching RA) */
+	uint32  rxcfrmocast;    /* number of received CNTRL frame (good FCS and not matching RA) */
+	uint32  rxrtsocast; /* number of received RTS not addressed to the MAC */
+	uint32  rxctsocast; /* number of received CTS not addressed to the MAC */
+	uint32  rxdfrmmcast;    /* number of RX Data multicast frames received by the MAC */
+	uint32  rxmfrmmcast;    /* number of RX Management multicast frames received by the MAC */
+	uint32  rxcfrmmcast;    /* number of RX Control multicast frames received by the MAC
+				 * (unlikely to see these)
+				 */
+	uint32  rxbeaconmbss;   /* beacons received from member of BSS */
+	uint32  rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+				  * other BSS (WDS FRAME)
+				  */
+	uint32  rxbeaconobss;   /* beacons received from other BSS */
+	uint32  rxrsptmout; /* Number of response timeouts for transmitted frames
+			     * expecting a response
+			     */
+	uint32  bcntxcancl; /* transmit beacons canceled due to receipt of beacon (IBSS) */
+	uint32  rxf0ovfl;   /* Number of receive fifo 0 overflows */
+	uint32  rxf1ovfl;   /* Number of receive fifo 1 overflows (obsolete) */
+	uint32  rxf2ovfl;   /* Number of receive fifo 2 overflows (obsolete) */
+	uint32  txsfovfl;   /* Number of transmit status fifo overflows (obsolete) */
+	uint32  pmqovfl;    /* Number of PMQ overflows */
+	uint32  rxcgprqfrm; /* Number of received Probe requests that made it into
+			     * the PRQ fifo
+			     */
+	uint32  rxcgprsqovfl;   /* Rx Probe Request Que overflow in the AP */
+	uint32  txcgprsfail;    /* Tx Probe Response Fail. AP sent probe response but did
+				 * not get ACK
+				 */
+	uint32  txcgprssuc; /* Tx Probe Response Success (ACK was received) */
+	uint32  prs_timeout;    /* Number of probe requests that were dropped from the PRQ
+				 * fifo because a probe response could not be sent out within
+				 * the time limit defined in M_PRS_MAXTIME
+				 */
 	uint32  rxnack;
 	uint32  frmscons;
 	uint32  txnack;
-	uint32  txglitch_nack;
-	uint32  txburst;
-
-
-	uint32  txfrag;
-	uint32  txmulti;
-	uint32  txfail;
-	uint32  txretry;
-	uint32  txretrie;
-	uint32  rxdup;
-	uint32  txrts;
-	uint32  txnocts;
-	uint32  txnoack;
-	uint32  rxfrag;
-	uint32  rxmulti;
-	uint32  rxcrc;
-	uint32  txfrmsnt;
-	uint32  rxundec;
-
-
-	uint32  tkipmicfaill;
-	uint32  tkipcntrmsr;
-	uint32  tkipreplay;
-	uint32  ccmpfmterr;
-	uint32  ccmpreplay;
-	uint32  ccmpundec;
-	uint32  fourwayfail;
-	uint32  wepundec;
-	uint32  wepicverr;
-	uint32  decsuccess;
-	uint32  tkipicverr;
-	uint32  wepexcluded;
-
-	uint32  rxundec_mcst;
-
-
-	uint32  tkipmicfaill_mcst;
-	uint32  tkipcntrmsr_mcst;
-	uint32  tkipreplay_mcst;
-	uint32  ccmpfmterr_mcst;
-	uint32  ccmpreplay_mcst;
-	uint32  ccmpundec_mcst;
-	uint32  fourwayfail_mcst;
-	uint32  wepundec_mcst;
-	uint32  wepicverr_mcst;
-	uint32  decsuccess_mcst;
-	uint32  tkipicverr_mcst;
-	uint32  wepexcluded_mcst;
-
-	uint32  txchanrej;
-	uint32  txexptime;
-	uint32  psmwds;
-	uint32  phywatchdog;
-
-
-	uint32  prq_entries_handled;
-	uint32  prq_undirected_entries;
-	uint32  prq_bad_entries;
-	uint32  atim_suppress_count;
-	uint32  bcn_template_not_ready;
-	uint32  bcn_template_not_ready_done;
-	uint32  late_tbtt_dpc;
-
-
-	uint32  rx1mbps;
-	uint32  rx2mbps;
-	uint32  rx5mbps5;
-	uint32  rx6mbps;
-	uint32  rx9mbps;
-	uint32  rx11mbps;
-	uint32  rx12mbps;
-	uint32  rx18mbps;
-	uint32  rx24mbps;
-	uint32  rx36mbps;
-	uint32  rx48mbps;
-	uint32  rx54mbps;
-	uint32  rx108mbps;
-	uint32  rx162mbps;
-	uint32  rx216mbps;
-	uint32  rx270mbps;
-	uint32  rx324mbps;
-	uint32  rx378mbps;
-	uint32  rx432mbps;
-	uint32  rx486mbps;
-	uint32  rx540mbps;
-
-
-	uint32  pktengrxducast;
-	uint32  pktengrxdmcast;
-
-	uint32  rfdisable;
-	uint32  bphy_rxcrsglitch;
-
-	uint32  txmpdu_sgi;
-	uint32  rxmpdu_sgi;
-	uint32  txmpdu_stbc;
-	uint32  rxmpdu_stbc;
-} wl_cnt_t;
+	uint32  txglitch_nack;  /* obsolete */
+	uint32  txburst;    /* obsolete */
+
+	/* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+	uint32  txfrag;     /* dot11TransmittedFragmentCount */
+	uint32  txmulti;    /* dot11MulticastTransmittedFrameCount */
+	uint32  txfail;     /* dot11FailedCount */
+	uint32  txretry;    /* dot11RetryCount */
+	uint32  txretrie;   /* dot11MultipleRetryCount */
+	uint32  rxdup;      /* dot11FrameduplicateCount */
+	uint32  txrts;      /* dot11RTSSuccessCount */
+	uint32  txnocts;    /* dot11RTSFailureCount */
+	uint32  txnoack;    /* dot11ACKFailureCount */
+	uint32  rxfrag;     /* dot11ReceivedFragmentCount */
+	uint32  rxmulti;    /* dot11MulticastReceivedFrameCount */
+	uint32  rxcrc;      /* dot11FCSErrorCount */
+	uint32  txfrmsnt;   /* dot11TransmittedFrameCount (bogus MIB?) */
+	uint32  rxundec;    /* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32  tkipmicfaill;   /* TKIPLocalMICFailures */
+	uint32  tkipcntrmsr;    /* TKIPCounterMeasuresInvoked */
+	uint32  tkipreplay; /* TKIPReplays */
+	uint32  ccmpfmterr; /* CCMPFormatErrors */
+	uint32  ccmpreplay; /* CCMPReplays */
+	uint32  ccmpundec;  /* CCMPDecryptErrors */
+	uint32  fourwayfail;    /* FourWayHandshakeFailures */
+	uint32  wepundec;   /* dot11WEPUndecryptableCount */
+	uint32  wepicverr;  /* dot11WEPICVErrorCount */
+	uint32  decsuccess; /* DecryptSuccessCount */
+	uint32  tkipicverr; /* TKIPICVErrorCount */
+	uint32  wepexcluded;    /* dot11WEPExcludedCount */
+
+	uint32  rxundec_mcst;   /* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32  tkipmicfaill_mcst;  /* TKIPLocalMICFailures */
+	uint32  tkipcntrmsr_mcst;   /* TKIPCounterMeasuresInvoked */
+	uint32  tkipreplay_mcst;    /* TKIPReplays */
+	uint32  ccmpfmterr_mcst;    /* CCMPFormatErrors */
+	uint32  ccmpreplay_mcst;    /* CCMPReplays */
+	uint32  ccmpundec_mcst; /* CCMPDecryptErrors */
+	uint32  fourwayfail_mcst;   /* FourWayHandshakeFailures */
+	uint32  wepundec_mcst;  /* dot11WEPUndecryptableCount */
+	uint32  wepicverr_mcst; /* dot11WEPICVErrorCount */
+	uint32  decsuccess_mcst;    /* DecryptSuccessCount */
+	uint32  tkipicverr_mcst;    /* TKIPICVErrorCount */
+	uint32  wepexcluded_mcst;   /* dot11WEPExcludedCount */
+
+	uint32  txchanrej;  /* Tx frames suppressed due to channel rejection */
+	uint32  txexptime;  /* Tx frames suppressed due to timer expiration */
+	uint32  psmwds;     /* Count PSM watchdogs */
+	uint32  phywatchdog;    /* Count Phy watchdogs (triggered by ucode) */
+
+	/* MBSS counters, AP only */
+	uint32  prq_entries_handled;    /* PRQ entries read in */
+	uint32  prq_undirected_entries; /*    which were bcast bss & ssid */
+	uint32  prq_bad_entries;    /*    which could not be translated to info */
+	uint32  atim_suppress_count;    /* TX suppressions on ATIM fifo */
+	uint32  bcn_template_not_ready; /* Template marked in use on send bcn ... */
+	uint32  bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+	uint32  late_tbtt_dpc;  /* TBTT DPC did not happen in time */
+
+	/* per-rate receive stat counters */
+	uint32  rx1mbps;    /* packets rx at 1Mbps */
+	uint32  rx2mbps;    /* packets rx at 2Mbps */
+	uint32  rx5mbps5;   /* packets rx at 5.5Mbps */
+	uint32  rx6mbps;    /* packets rx at 6Mbps */
+	uint32  rx9mbps;    /* packets rx at 9Mbps */
+	uint32  rx11mbps;   /* packets rx at 11Mbps */
+	uint32  rx12mbps;   /* packets rx at 12Mbps */
+	uint32  rx18mbps;   /* packets rx at 18Mbps */
+	uint32  rx24mbps;   /* packets rx at 24Mbps */
+	uint32  rx36mbps;   /* packets rx at 36Mbps */
+	uint32  rx48mbps;   /* packets rx at 48Mbps */
+	uint32  rx54mbps;   /* packets rx at 54Mbps */
+	uint32  rx108mbps;  /* packets rx at 108mbps */
+	uint32  rx162mbps;  /* packets rx at 162mbps */
+	uint32  rx216mbps;  /* packets rx at 216 mbps */
+	uint32  rx270mbps;  /* packets rx at 270 mbps */
+	uint32  rx324mbps;  /* packets rx at 324 mbps */
+	uint32  rx378mbps;  /* packets rx at 378 mbps */
+	uint32  rx432mbps;  /* packets rx at 432 mbps */
+	uint32  rx486mbps;  /* packets rx at 486 mbps */
+	uint32  rx540mbps;  /* packets rx at 540 mbps */
+
+	/* pkteng rx frame stats */
+	uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+	uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+	uint32  rfdisable;  /* count of radio disables */
+	uint32  bphy_rxcrsglitch;   /* PHY count of bphy glitches */
+
+	uint32  txmpdu_sgi; /* count for sgi transmit */
+	uint32  rxmpdu_sgi; /* count for sgi received */
+	uint32  txmpdu_stbc;    /* count for stbc transmit */
+	uint32  rxmpdu_stbc;    /* count for stbc received */
+} wl_cnt_ver_six_t;
+
+#define	WL_DELTA_STATS_T_VERSION	1	/* current version of wl_delta_stats_t struct */
 
-
-#define WL_WME_CNT_VERSION  1
+typedef struct {
+	uint16 version;     /* see definition of WL_DELTA_STATS_T_VERSION */
+	uint16 length;      /* length of entire structure */
+
+	/* transmit stat counters */
+	uint32 txframe;     /* tx data frames */
+	uint32 txbyte;      /* tx data bytes */
+	uint32 txretrans;   /* tx mac retransmits */
+	uint32 txfail;      /* tx failures */
+
+	/* receive stat counters */
+	uint32 rxframe;     /* rx data frames */
+	uint32 rxbyte;      /* rx data bytes */
+
+	/* per-rate receive stat counters */
+	uint32  rx1mbps;	/* packets rx at 1Mbps */
+	uint32  rx2mbps;	/* packets rx at 2Mbps */
+	uint32  rx5mbps5;	/* packets rx at 5.5Mbps */
+	uint32  rx6mbps;	/* packets rx at 6Mbps */
+	uint32  rx9mbps;	/* packets rx at 9Mbps */
+	uint32  rx11mbps;	/* packets rx at 11Mbps */
+	uint32  rx12mbps;	/* packets rx at 12Mbps */
+	uint32  rx18mbps;	/* packets rx at 18Mbps */
+	uint32  rx24mbps;	/* packets rx at 24Mbps */
+	uint32  rx36mbps;	/* packets rx at 36Mbps */
+	uint32  rx48mbps;	/* packets rx at 48Mbps */
+	uint32  rx54mbps;	/* packets rx at 54Mbps */
+	uint32  rx108mbps; 	/* packets rx at 108mbps */
+	uint32  rx162mbps;	/* packets rx at 162mbps */
+	uint32  rx216mbps;	/* packets rx at 216 mbps */
+	uint32  rx270mbps;	/* packets rx at 270 mbps */
+	uint32  rx324mbps;	/* packets rx at 324 mbps */
+	uint32  rx378mbps;	/* packets rx at 378 mbps */
+	uint32  rx432mbps;	/* packets rx at 432 mbps */
+	uint32  rx486mbps;	/* packets rx at 486 mbps */
+	uint32  rx540mbps;	/* packets rx at 540 mbps */
+} wl_delta_stats_t;
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define WL_WME_CNT_VERSION	1	/* current version of wl_wme_cnt_t */
 
 typedef struct {
 	uint32 packets;
@@ -2016,35 +3545,297 @@ typedef struct {
 } wl_traffic_stats_t;
 
 typedef struct {
-	uint16  version;
-	uint16  length;
+	uint16	version;	/* see definition of WL_WME_CNT_VERSION */
+	uint16	length;		/* length of entire structure */
 
-	wl_traffic_stats_t tx[AC_COUNT];
-	wl_traffic_stats_t tx_failed[AC_COUNT];
-	wl_traffic_stats_t rx[AC_COUNT];
-	wl_traffic_stats_t rx_failed[AC_COUNT];
+	wl_traffic_stats_t tx[AC_COUNT];	/* Packets transmitted */
+	wl_traffic_stats_t tx_failed[AC_COUNT];	/* Packets dropped or failed to transmit */
+	wl_traffic_stats_t rx[AC_COUNT];	/* Packets received */
+	wl_traffic_stats_t rx_failed[AC_COUNT];	/* Packets failed to receive */
 
-	wl_traffic_stats_t forward[AC_COUNT];
+	wl_traffic_stats_t forward[AC_COUNT];	/* Packets forwarded by AP */
 
-	wl_traffic_stats_t tx_expired[AC_COUNT];
+	wl_traffic_stats_t tx_expired[AC_COUNT];	/* packets dropped due to lifetime expiry */
 
 } wl_wme_cnt_t;
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 struct wl_msglevel2 {
 	uint32 low;
 	uint32 high;
 };
 
+typedef struct wl_mkeep_alive_pkt {
+	uint16	version; /* Version for mkeep_alive */
+	uint16	length; /* length of fixed parameters in the structure */
+	uint32	period_msec;
+	uint16	len_bytes;
+	uint8	keep_alive_id; /* 0 - 3 for N = 4 */
+	uint8	data[1];
+} wl_mkeep_alive_pkt_t;
+
+#define WL_MKEEP_ALIVE_VERSION		1
+#define WL_MKEEP_ALIVE_FIXED_LEN	OFFSETOF(wl_mkeep_alive_pkt_t, data)
+#define WL_MKEEP_ALIVE_PRECISION	500
+
+#ifdef WLBA
+
+#define WLC_BA_CNT_VERSION  1   /* current version of wlc_ba_cnt_t */
+
+/* block ack related stats */
+typedef struct wlc_ba_cnt {
+	uint16  version;    /* WLC_BA_CNT_VERSION */
+	uint16  length;     /* length of entire structure */
+
+	/* transmit stat counters */
+	uint32 txpdu;       /* pdus sent */
+	uint32 txsdu;       /* sdus sent */
+	uint32 txfc;        /* tx side flow controlled packets */
+	uint32 txfci;       /* tx side flow control initiated */
+	uint32 txretrans;   /* retransmitted pdus */
+	uint32 txbatimer;   /* ba resend due to timer */
+	uint32 txdrop;      /* dropped packets */
+	uint32 txaddbareq;  /* addba req sent */
+	uint32 txaddbaresp; /* addba resp sent */
+	uint32 txdelba;     /* delba sent */
+	uint32 txba;        /* ba sent */
+	uint32 txbar;       /* bar sent */
+	uint32 txpad[4];    /* future */
+
+	/* receive side counters */
+	uint32 rxpdu;       /* pdus recd */
+	uint32 rxqed;       /* pdus buffered before sending up */
+	uint32 rxdup;       /* duplicate pdus */
+	uint32 rxnobuf;     /* pdus discarded due to no buf */
+	uint32 rxaddbareq;  /* addba req recd */
+	uint32 rxaddbaresp; /* addba resp recd */
+	uint32 rxdelba;     /* delba recd */
+	uint32 rxba;        /* ba recd */
+	uint32 rxbar;       /* bar recd */
+	uint32 rxinvba;     /* invalid ba recd */
+	uint32 rxbaholes;   /* ba recd with holes */
+	uint32 rxunexp;     /* unexpected packets */
+	uint32 rxpad[4];    /* future */
+} wlc_ba_cnt_t;
+#endif /* WLBA */
+
+/* structure for per-tid ampdu control */
+struct ampdu_tid_control {
+	uint8 tid;			/* tid */
+	uint8 enable;			/* enable/disable */
+};
 
+/* structure for identifying ea/tid for sending addba/delba */
+struct ampdu_ea_tid {
+	struct ether_addr ea;		/* Station address */
+	uint8 tid;			/* tid */
+};
+/* structure for identifying retry/tid for retry_limit_tid/rr_retry_limit_tid */
+struct ampdu_retry_tid {
+	uint8 tid;	/* tid */
+	uint8 retry;	/* retry value */
+};
 
-#define WLC_ROAM_TRIGGER_DEFAULT    0
-#define WLC_ROAM_TRIGGER_BANDWIDTH  1
-#define WLC_ROAM_TRIGGER_DISTANCE   2
-#define WLC_ROAM_TRIGGER_AUTO       3
-#define WLC_ROAM_TRIGGER_MAX_VALUE  3
+/* Different discovery modes for dpt */
+#define	DPT_DISCOVERY_MANUAL	0x01	/* manual discovery mode */
+#define	DPT_DISCOVERY_AUTO	0x02	/* auto discovery mode */
+#define	DPT_DISCOVERY_SCAN	0x04	/* scan-based discovery mode */
+
+/* different path selection values */
+#define DPT_PATHSEL_AUTO	0	/* auto mode for path selection */
+#define DPT_PATHSEL_DIRECT	1	/* always use direct DPT path */
+#define DPT_PATHSEL_APPATH	2	/* always use AP path */
+
+/* different ops for deny list */
+#define DPT_DENY_LIST_ADD 	1	/* add to dpt deny list */
+#define DPT_DENY_LIST_REMOVE 	2	/* remove from dpt deny list */
+
+/* different ops for manual end point */
+#define DPT_MANUAL_EP_CREATE	1	/* create manual dpt endpoint */
+#define DPT_MANUAL_EP_MODIFY	2	/* modify manual dpt endpoint */
+#define DPT_MANUAL_EP_DELETE	3	/* delete manual dpt endpoint */
+
+/* structure for dpt iovars */
+typedef struct dpt_iovar {
+	struct ether_addr ea;		/* Station address */
+	uint8 mode;			/* mode: depends on iovar */
+	uint32 pad;			/* future */
+} dpt_iovar_t;
+
+/* flags to indicate DPT status */
+#define	DPT_STATUS_ACTIVE	0x01	/* link active (though may be suspended) */
+#define	DPT_STATUS_AES		0x02	/* link secured through AES encryption */
+#define	DPT_STATUS_FAILED	0x04	/* DPT link failed */
+
+#define	DPT_FNAME_LEN		48	/* Max length of friendly name */
+
+typedef struct dpt_status {
+	uint8 status;			/* flags to indicate status */
+	uint8 fnlen;			/* length of friendly name */
+	uchar name[DPT_FNAME_LEN];	/* friendly name */
+	uint32 rssi;			/* RSSI of the link */
+	sta_info_t sta;			/* sta info */
+} dpt_status_t;
+
+/* structure for dpt list */
+typedef struct dpt_list {
+	uint32 num;			/* number of entries in struct */
+	dpt_status_t status[1];		/* per station info */
+} dpt_list_t;
+
+/* structure for dpt friendly name */
+typedef struct dpt_fname {
+	uint8 len;			/* length of friendly name */
+	uchar name[DPT_FNAME_LEN];	/* friendly name */
+} dpt_fname_t;
+
+#define BDD_FNAME_LEN       32  /* Max length of friendly name */
+typedef struct bdd_fname {
+	uint8 len;          /* length of friendly name */
+	uchar name[BDD_FNAME_LEN];  /* friendly name */
+} bdd_fname_t;
+
+/* structure for addts arguments */
+/* For ioctls that take a list of TSPEC */
+struct tslist {
+	int count;			/* number of tspecs */
+	struct tsinfo_arg tsinfo[1];	/* variable length array of tsinfo */
+};
 
+#ifdef WLTDLS
+/* different ops for manual end point */
+#define TDLS_MANUAL_EP_CREATE		1	/* create manual dpt endpoint */
+#define TDLS_MANUAL_EP_MODIFY		2	/* modify manual dpt endpoint */
+#define TDLS_MANUAL_EP_DELETE		3	/* delete manual dpt endpoint */
+#define TDLS_MANUAL_EP_PM		4	/*  put dpt endpoint in PM mode */
+#define TDLS_MANUAL_EP_WAKE		5	/* wake up dpt endpoint from PM */
+#define TDLS_MANUAL_EP_DISCOVERY	6	/* discover if endpoint is TDLS capable */
+#define TDLS_MANUAL_EP_CHSW		7	/* channel switch */
+#define TDLS_MANUAL_EP_WFD_TPQ	8	/* WiFi-Display Tunneled Probe reQuest */
+
+/* structure for tdls iovars */
+typedef struct tdls_iovar {
+	struct ether_addr ea;		/* Station address */
+	uint8 mode;			/* mode: depends on iovar */
+	chanspec_t chanspec;
+	uint32 pad;			/* future */
+} tdls_iovar_t;
+
+/* modes */
+#define TDLS_WFD_IE_TX 			0
+#define TDLS_WFD_IE_RX 			1
+#define TDLS_WFD_PROBE_IE_TX	2
+#define TDLS_WFD_PROBE_IE_RX	3
+#define TDLS_WFD_IE_SIZE 		512
+/* structure for tdls wfd ie */
+typedef struct tdls_wfd_ie_iovar {
+	struct ether_addr ea;		/* Station address */
+	uint8 mode;
+	uint16 length;
+	uint8 data[TDLS_WFD_IE_SIZE];
+} tdls_wfd_ie_iovar_t;
+#endif /* WLTDLS */
+
+/* structure for addts/delts arguments */
+typedef struct tspec_arg {
+	uint16 version;			/* see definition of TSPEC_ARG_VERSION */
+	uint16 length;			/* length of entire structure */
+	uint flag;			/* bit field */
+	/* TSPEC Arguments */
+	struct tsinfo_arg tsinfo;	/* TS Info bit field */
+	uint16 nom_msdu_size;		/* (Nominal or fixed) MSDU Size (bytes) */
+	uint16 max_msdu_size;		/* Maximum MSDU Size (bytes) */
+	uint min_srv_interval;		/* Minimum Service Interval (us) */
+	uint max_srv_interval;		/* Maximum Service Interval (us) */
+	uint inactivity_interval;	/* Inactivity Interval (us) */
+	uint suspension_interval;	/* Suspension Interval (us) */
+	uint srv_start_time;		/* Service Start Time (us) */
+	uint min_data_rate;		/* Minimum Data Rate (bps) */
+	uint mean_data_rate;		/* Mean Data Rate (bps) */
+	uint peak_data_rate;		/* Peak Data Rate (bps) */
+	uint max_burst_size;		/* Maximum Burst Size (bytes) */
+	uint delay_bound;		/* Delay Bound (us) */
+	uint min_phy_rate;		/* Minimum PHY Rate (bps) */
+	uint16 surplus_bw;		/* Surplus Bandwidth Allowance (range 1.0 to 8.0) */
+	uint16 medium_time;		/* Medium Time (32 us/s periods) */
+	uint8 dialog_token;		/* dialog token */
+} tspec_arg_t;
+
+/* tspec arg for desired station */
+typedef	struct tspec_per_sta_arg {
+	struct ether_addr ea;
+	struct tspec_arg ts;
+} tspec_per_sta_arg_t;
+
+/* structure for max bandwidth for each access category */
+typedef	struct wme_max_bandwidth {
+	uint32	ac[AC_COUNT];	/* max bandwidth for each access category */
+} wme_max_bandwidth_t;
+
+#define WL_WME_MBW_PARAMS_IO_BYTES (sizeof(wme_max_bandwidth_t))
+
+/* current version of wl_tspec_arg_t struct */
+#define	TSPEC_ARG_VERSION		2	/* current version of wl_tspec_arg_t struct */
+#define TSPEC_ARG_LENGTH		55	/* argument length from tsinfo to medium_time */
+#define TSPEC_DEFAULT_DIALOG_TOKEN	42	/* default dialog token */
+#define TSPEC_DEFAULT_SBW_FACTOR	0x3000	/* default surplus bw */
+
+
+#define WL_WOWL_KEEPALIVE_MAX_PACKET_SIZE  80
+#define WLC_WOWL_MAX_KEEPALIVE	2
+
+/* define for flag */
+#define TSPEC_PENDING		0	/* TSPEC pending */
+#define TSPEC_ACCEPTED		1	/* TSPEC accepted */
+#define TSPEC_REJECTED		2	/* TSPEC rejected */
+#define TSPEC_UNKNOWN		3	/* TSPEC unknown */
+#define TSPEC_STATUS_MASK	7	/* TSPEC status mask */
+
+
+/* Software feature flag defines used by wlfeatureflag */
+#ifdef WLAFTERBURNER
+#define WL_SWFL_ABBFL		0x0001 /* Allow Afterburner on systems w/o hardware BFL */
+#define WL_SWFL_ABENCORE	0x0002 /* Allow AB on non-4318E chips */
+#endif /* WLAFTERBURNER */
+#define WL_SWFL_NOHWRADIO	0x0004
+#define WL_SWFL_FLOWCONTROL	0x0008 /* Enable backpressure to OS stack */
+#define WL_SWFL_WLBSSSORT	0x0010 /* Per-port supports sorting of BSS */
+
+#define WL_LIFETIME_MAX 0xFFFF /* Max value in ms */
+
+/* Packet lifetime configuration per ac */
+typedef struct wl_lifetime {
+	uint32 ac;	        /* access class */
+	uint32 lifetime;    /* Packet lifetime value in ms */
+} wl_lifetime_t;
+
+/* Channel Switch Announcement param */
+typedef struct wl_chan_switch {
+	uint8 mode;		/* value 0 or 1 */
+	uint8 count;		/* count # of beacons before switching */
+	chanspec_t chspec;	/* chanspec */
+	uint8 reg;		/* regulatory class */
+} wl_chan_switch_t;
+
+/* Roaming trigger definitions for WLC_SET_ROAM_TRIGGER.
+ *
+ * (-100 < value < 0)   value is used directly as a roaming trigger in dBm
+ * (0 <= value) value specifies a logical roaming trigger level from
+ *                      the list below
+ *
+ * WLC_GET_ROAM_TRIGGER always returns roaming trigger value in dBm, never
+ * the logical roam trigger value.
+ */
+#define WLC_ROAM_TRIGGER_DEFAULT	0 /* default roaming trigger */
+#define WLC_ROAM_TRIGGER_BANDWIDTH	1 /* optimize for bandwidth roaming trigger */
+#define WLC_ROAM_TRIGGER_DISTANCE	2 /* optimize for distance roaming trigger */
+#define WLC_ROAM_TRIGGER_AUTO		3 /* auto-detect environment */
+#define WLC_ROAM_TRIGGER_MAX_VALUE	3 /* max. valid value */
 
-#define WPA_AUTH_PFN_ANY	0xffffffff
+#define WLC_ROAM_NEVER_ROAM_TRIGGER	(-100) /* Avoid Roaming by setting a large value */
+
+/* Preferred Network Offload (PNO, formerly PFN) defines */
+#define WPA_AUTH_PFN_ANY	0xffffffff	/* for PFN, match only ssid */
 
 enum {
 	PFN_LIST_ORDER,
@@ -2059,26 +3850,34 @@ enum {
 enum {
 	OFF_ADAPT,
 	SMART_ADAPT,
-	STRICT_ADAPT
+	STRICT_ADAPT,
+	SLOW_ADAPT
 };
 
 #define SORT_CRITERIA_BIT		0
 #define AUTO_NET_SWITCH_BIT		1
-#define ENABLE_BKGRD_SCAN_BIT	2
+#define ENABLE_BKGRD_SCAN_BIT		2
 #define IMMEDIATE_SCAN_BIT		3
 #define	AUTO_CONNECT_BIT		4
 #define	ENABLE_BD_SCAN_BIT		5
-#define ENABLE_ADAPTSCAN_BIT	6
-
-#define SORT_CRITERIA_MASK		0x01
-#define AUTO_NET_SWITCH_MASK	0x02
-#define ENABLE_BKGRD_SCAN_MASK	0x04
-#define IMMEDIATE_SCAN_MASK		0x08
-#define	AUTO_CONNECT_MASK		0x10
-#define ENABLE_BD_SCAN_MASK		0x20
-#define ENABLE_ADAPTSCAN_MASK	0xc0
-
-#define PFN_VERSION				2
+#define ENABLE_ADAPTSCAN_BIT		6
+#define IMMEDIATE_EVENT_BIT		8
+#define SUPPRESS_SSID_BIT		9
+#define ENABLE_NET_OFFLOAD_BIT		10
+
+#define SORT_CRITERIA_MASK		0x0001
+#define AUTO_NET_SWITCH_MASK		0x0002
+#define ENABLE_BKGRD_SCAN_MASK		0x0004
+#define IMMEDIATE_SCAN_MASK		0x0008
+#define	AUTO_CONNECT_MASK		0x0010
+
+#define ENABLE_BD_SCAN_MASK		0x0020
+#define ENABLE_ADAPTSCAN_MASK	0x00c0
+#define IMMEDIATE_EVENT_MASK	0x0100
+#define SUPPRESS_SSID_MASK	0x0200
+#define ENABLE_NET_OFFLOAD_MASK	0x0400
+
+#define PFN_VERSION		2
 #define PFN_SCANRESULT_VERSION	1
 #define MAX_PFN_LIST_COUNT	16
 
@@ -2088,20 +3887,20 @@ enum {
 #define DEFAULT_BESTN			2
 #define DEFAULT_MSCAN			0
 #define DEFAULT_REPEAT			10
-#define DEFAULT_EXP				2
-
+#define DEFAULT_EXP			2
 
+/* PFN network info structure */
 typedef struct wl_pfn_subnet_info {
 	struct ether_addr BSSID;
-	uint8	channel;
+	uint8	channel; /* channel number only */
 	uint8	SSID_len;
 	uint8	SSID[32];
 } wl_pfn_subnet_info_t;
 
 typedef struct wl_pfn_net_info {
 	wl_pfn_subnet_info_t pfnsubnet;
-	int16	RSSI;
-	uint16	timestamp;
+	int16	RSSI; /* receive signal strength (in dBm) */
+	uint16	timestamp; /* age in seconds */
 } wl_pfn_net_info_t;
 
 typedef struct wl_pfn_scanresults {
@@ -2111,70 +3910,136 @@ typedef struct wl_pfn_scanresults {
 	wl_pfn_net_info_t netinfo[1];
 } wl_pfn_scanresults_t;
 
-
+/* PFN data structure */
 typedef struct wl_pfn_param {
-	int32 version;
-	int32 scan_freq;
-	int32 lost_network_timeout;
-	int16 flags;
-	int16 rssi_margin;
-	uint8 bestn;
-	uint8 mscan;
-	uint8 repeat;
-	uint8 exp;
+	int32 version;			/* PNO parameters version */
+	int32 scan_freq;		/* Scan frequency */
+	int32 lost_network_timeout;	/* Timeout in sec. to declare
+					* discovered network as lost
+					*/
+	int16 flags;			/* Bit field to control features
+					* of PFN such as sort criteria auto
+					* enable switch and background scan
+					*/
+	int16 rssi_margin;		/* Margin to avoid jitter for choosing a
+					* PFN based on RSSI sort criteria
+					*/
+	uint8 bestn;			/* number of best networks in each scan */
+	uint8 mscan;			/* number of scans recorded */
+	uint8 repeat;			/* Minimum number of scan intervals
+					*before scan frequency changes in adaptive scan
+					*/
+	uint8 exp;			/* Exponent of 2 for maximum scan interval */
+	int32 slow_freq;		/* slow scan period */
 } wl_pfn_param_t;
 
 typedef struct wl_pfn_bssid {
-	struct ether_addr 	macaddr;
-
-	uint16				flags;
+	struct ether_addr	macaddr;
+	/* Bit4: suppress_lost, Bit3: suppress_found */
+	uint16			flags;
 } wl_pfn_bssid_t;
 #define WL_PFN_SUPPRESSFOUND_MASK	0x08
 #define WL_PFN_SUPPRESSLOST_MASK	0x10
+#define WL_PFN_RSSI_MASK		0xff00
+#define WL_PFN_RSSI_SHIFT		8
 
 typedef struct wl_pfn_cfg {
-	uint32				reporttype;
-	int32				channel_num;
-	uint16				channel_list[WL_NUMCHANNELS];
+	uint32			reporttype;
+	int32			channel_num;
+	uint16			channel_list[WL_NUMCHANNELS];
 } wl_pfn_cfg_t;
-#define WL_PFN_REPORT_ALLNET 	0
-#define WL_PFN_REPORT_SSIDNET 	1
-#define WL_PFN_REPORT_BSSIDNET 	2
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
 
 typedef struct wl_pfn {
-	wlc_ssid_t		ssid;
-	int32			flags;
-	int32			infra;
-	int32			auth;
-	int32			wpa_auth;
-	int32			wsec;
+	wlc_ssid_t		ssid;		/* ssid name and its length */
+	int32			flags;		/* bit2: hidden */
+	int32			infra;		/* BSS Vs IBSS */
+	int32			auth;		/* Open Vs Closed */
+	int32			wpa_auth;	/* WPA type */
+	int32			wsec;		/* wsec value */
 } wl_pfn_t;
-#define WL_PFN_HIDDEN_BIT		2
-#define PNO_SCAN_MAX_FW		508*1000
-#define PNO_SCAN_MAX_FW_SEC	PNO_SCAN_MAX_FW/1000
-#define PNO_SCAN_MIN_FW_SEC	10
-#define WL_PFN_HIDDEN_MASK		0x4
+#define WL_PFN_HIDDEN_BIT	2
+#define PNO_SCAN_MAX_FW		508*1000	/* max time scan time in msec */
+#define PNO_SCAN_MAX_FW_SEC	PNO_SCAN_MAX_FW/1000 /* max time scan time in SEC */
+#define PNO_SCAN_MIN_FW_SEC	10		/* min time scan time in SEC */
+#define WL_PFN_HIDDEN_MASK	0x4
 
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
-#define TOE_TX_CSUM_OL      0x00000001
-#define TOE_RX_CSUM_OL      0x00000002
+/* Service discovery */
+typedef struct {
+	uint8	transaction_id;	/* Transaction id */
+	uint8	protocol;	/* Service protocol type */
+	uint16	query_len;	/* Length of query */
+	uint16	response_len;	/* Length of response */
+	uint8	qrbuf[1];
+} wl_p2po_qr_t;
 
+typedef struct {
+	uint16			period;			/* extended listen period */
+	uint16			interval;		/* extended listen interval */
+} wl_p2po_listen_t;
 
-#define TOE_ERRTEST_TX_CSUM 0x00000001
-#define TOE_ERRTEST_RX_CSUM 0x00000002
-#define TOE_ERRTEST_RX_CSUM2    0x00000004
+/* ANQP offload */
 
-struct toe_ol_stats_t {
+#define ANQPO_MAX_QUERY_SIZE		256
+typedef struct {
+	uint16 max_retransmit;		/* -1 use default, max retransmit on no ACK from peer */
+	uint16 response_timeout;	/* -1 use default, msec to wait for resp after tx packet */
+	uint16 max_comeback_delay;	/* -1 use default, max comeback delay in resp else fail */
+	uint16 max_retries;			/* -1 use default, max retries on failure */
+	uint16 query_len;			/* length of ANQP query */
+	uint8 query_data[1];		/* ANQP encoded query (max ANQPO_MAX_QUERY_SIZE) */
+} wl_anqpo_set_t;
 
-	uint32 tx_summed;
+typedef struct {
+	uint16 channel;				/* channel of the peer */
+	struct ether_addr addr;		/* addr of the peer */
+} wl_anqpo_peer_t;
 
+#define ANQPO_MAX_PEER_LIST			64
+typedef struct {
+	uint16 count;				/* number of peers in list */
+	wl_anqpo_peer_t peer[1];	/* max ANQPO_MAX_PEER_LIST */
+} wl_anqpo_peer_list_t;
+
+#define ANQPO_MAX_IGNORE_SSID		64
+typedef struct {
+	bool is_clear;				/* set to clear list (not used on GET) */
+	uint16 count;				/* number of SSID in list */
+	wlc_ssid_t ssid[1];			/* max ANQPO_MAX_IGNORE_SSID */
+} wl_anqpo_ignore_ssid_list_t;
+
+#define ANQPO_MAX_IGNORE_BSSID		64
+typedef struct {
+	bool is_clear;				/* set to clear list (not used on GET) */
+	uint16 count;				/* number of addr in list */
+	struct ether_addr bssid[1];	/* max ANQPO_MAX_IGNORE_BSSID */
+} wl_anqpo_ignore_bssid_list_t;
+
+/* TCP Checksum Offload defines */
+#define TOE_TX_CSUM_OL		0x00000001
+#define TOE_RX_CSUM_OL		0x00000002
 
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* TCP Checksum Offload error injection for testing */
+#define TOE_ERRTEST_TX_CSUM	0x00000001
+#define TOE_ERRTEST_RX_CSUM	0x00000002
+#define TOE_ERRTEST_RX_CSUM2	0x00000004
+
+struct toe_ol_stats_t {
+	/* Num of tx packets that don't need to be checksummed */
+	uint32 tx_summed;
+
+	/* Num of tx packets where checksum is filled by offload engine */
 	uint32 tx_iph_fill;
 	uint32 tx_tcp_fill;
 	uint32 tx_udp_fill;
 	uint32 tx_icmp_fill;
 
-
+	/*  Num of rx packets where toe finds out if checksum is good or bad */
 	uint32 rx_iph_good;
 	uint32 rx_iph_bad;
 	uint32 rx_tcp_good;
@@ -2184,251 +4049,312 @@ struct toe_ol_stats_t {
 	uint32 rx_icmp_good;
 	uint32 rx_icmp_bad;
 
-
+	/* Num of tx packets in which csum error is injected */
 	uint32 tx_tcp_errinj;
 	uint32 tx_udp_errinj;
 	uint32 tx_icmp_errinj;
 
-
+	/* Num of rx packets in which csum error is injected */
 	uint32 rx_tcp_errinj;
 	uint32 rx_udp_errinj;
 	uint32 rx_icmp_errinj;
 };
 
+/* ARP Offload feature flags for arp_ol iovar */
+#define ARP_OL_AGENT		0x00000001
+#define ARP_OL_SNOOP		0x00000002
+#define ARP_OL_HOST_AUTO_REPLY	0x00000004
+#define ARP_OL_PEER_AUTO_REPLY	0x00000008
 
-#define ARP_OL_AGENT        0x00000001
-#define ARP_OL_SNOOP        0x00000002
-#define ARP_OL_HOST_AUTO_REPLY  0x00000004
-#define ARP_OL_PEER_AUTO_REPLY  0x00000008
-
-
-#define ARP_ERRTEST_REPLY_PEER  0x1
-#define ARP_ERRTEST_REPLY_HOST  0x2
-
-#define ARP_MULTIHOMING_MAX 8
+/* ARP Offload error injection */
+#define ARP_ERRTEST_REPLY_PEER	0x1
+#define ARP_ERRTEST_REPLY_HOST	0x2
 
+#define ARP_MULTIHOMING_MAX	8	/* Maximum local host IP addresses */
+#define ND_MULTIHOMING_MAX	10	/* Maximum local host IP addresses */
 
+/* Arp offload statistic counts */
 struct arp_ol_stats_t {
-	uint32  host_ip_entries;
-	uint32  host_ip_overflow;
+	uint32  host_ip_entries;	/* Host IP table addresses (more than one if multihomed) */
+	uint32  host_ip_overflow;	/* Host IP table additions skipped due to overflow */
 
-	uint32  arp_table_entries;
-	uint32  arp_table_overflow;
+	uint32  arp_table_entries;	/* ARP table entries */
+	uint32  arp_table_overflow;	/* ARP table additions skipped due to overflow */
 
-	uint32  host_request;
-	uint32  host_reply;
-	uint32  host_service;
+	uint32  host_request;		/* ARP requests from host */
+	uint32  host_reply;		/* ARP replies from host */
+	uint32  host_service;		/* ARP requests from host serviced by ARP Agent */
 
-	uint32  peer_request;
-	uint32  peer_request_drop;
-	uint32  peer_reply;
-	uint32  peer_reply_drop;
-	uint32  peer_service;
+	uint32  peer_request;		/* ARP requests received from network */
+	uint32  peer_request_drop;	/* ARP requests from network that were dropped */
+	uint32  peer_reply;		/* ARP replies received from network */
+	uint32  peer_reply_drop;	/* ARP replies from network that were dropped */
+	uint32  peer_service;		/* ARP request from host serviced by ARP Agent */
 };
 
+/* NS offload statistic counts */
+struct nd_ol_stats_t {
+	uint32  host_ip_entries;    /* Host IP table addresses (more than one if multihomed) */
+	uint32  host_ip_overflow;   /* Host IP table additions skipped due to overflow */
+	uint32  peer_request;       /* NS requests received from network */
+	uint32  peer_request_drop;  /* NS requests from network that were dropped */
+	uint32  peer_reply_drop;    /* NA replies from network that were dropped */
+	uint32  peer_service;       /* NS request from host serviced by firmware */
+};
 
+/*
+ * Keep-alive packet offloading.
+ */
 
-
+/* NAT keep-alive packets format: specifies the re-transmission period, the packet
+ * length, and packet contents.
+ */
 typedef struct wl_keep_alive_pkt {
-	uint32  period_msec;
-	uint16  len_bytes;
-	uint8   data[1];
+	uint32	period_msec;	/* Retransmission period (0 to disable packet re-transmits) */
+	uint16	len_bytes;	/* Size of packet to transmit (0 to disable packet re-transmits) */
+	uint8	data[1];	/* Variable length packet to transmit.  Contents should include
+				 * entire ethernet packet (enet header, IP header, UDP header,
+				 * and UDP payload) in network byte order.
+				 */
 } wl_keep_alive_pkt_t;
 
-#define WL_KEEP_ALIVE_FIXED_LEN     OFFSETOF(wl_keep_alive_pkt_t, data)
-
-
+#define WL_KEEP_ALIVE_FIXED_LEN		OFFSETOF(wl_keep_alive_pkt_t, data)
 
+/*
+ * Dongle pattern matching filter.
+ */
 
+/* Packet filter types. Currently, only pattern matching is supported. */
 typedef enum wl_pkt_filter_type {
-	WL_PKT_FILTER_TYPE_PATTERN_MATCH
+	WL_PKT_FILTER_TYPE_PATTERN_MATCH	/* Pattern matching filter */
 } wl_pkt_filter_type_t;
 
 #define WL_PKT_FILTER_TYPE wl_pkt_filter_type_t
 
-
+/* Pattern matching filter. Specifies an offset within received packets to
+ * start matching, the pattern to match, the size of the pattern, and a bitmask
+ * that indicates which bits within the pattern should be matched.
+ */
 typedef struct wl_pkt_filter_pattern {
-	uint32  offset;
-	uint32  size_bytes;
-	uint8   mask_and_pattern[1];
+	uint32	offset;		/* Offset within received packet to start pattern matching.
+				 * Offset '0' is the first byte of the ethernet header.
+				 */
+	uint32	size_bytes;	/* Size of the pattern.  Bitmask must be the same size. */
+	uint8   mask_and_pattern[1]; /* Variable length mask and pattern data.  mask starts
+				      * at offset 0.  Pattern immediately follows mask.
+				      */
 } wl_pkt_filter_pattern_t;
 
-
+/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
 typedef struct wl_pkt_filter {
-	uint32  id;
-	uint32  type;
-	uint32  negate_match;
-	union {
-		wl_pkt_filter_pattern_t pattern;
+	uint32	id;		/* Unique filter id, specified by app. */
+	uint32	type;		/* Filter type (WL_PKT_FILTER_TYPE_xxx). */
+	uint32	negate_match;	/* Negate the result of filter matches */
+	union {			/* Filter definitions */
+		wl_pkt_filter_pattern_t pattern;	/* Pattern matching filter */
 	} u;
 } wl_pkt_filter_t;
 
-#define WL_PKT_FILTER_FIXED_LEN       OFFSETOF(wl_pkt_filter_t, u)
-#define WL_PKT_FILTER_PATTERN_FIXED_LEN   OFFSETOF(wl_pkt_filter_pattern_t, mask_and_pattern)
-
+#define WL_PKT_FILTER_FIXED_LEN		  OFFSETOF(wl_pkt_filter_t, u)
+#define WL_PKT_FILTER_PATTERN_FIXED_LEN	  OFFSETOF(wl_pkt_filter_pattern_t, mask_and_pattern)
 
+/* IOVAR "pkt_filter_enable" parameter. */
 typedef struct wl_pkt_filter_enable {
-	uint32  id;
-	uint32  enable;
+	uint32	id;		/* Unique filter id */
+	uint32	enable;		/* Enable/disable bool */
 } wl_pkt_filter_enable_t;
 
-
+/* IOVAR "pkt_filter_list" parameter. Used to retrieve a list of installed filters. */
 typedef struct wl_pkt_filter_list {
-	uint32  num;
-	wl_pkt_filter_t filter[1];
+	uint32	num;		/* Number of installed packet filters */
+	wl_pkt_filter_t	filter[1];	/* Variable array of packet filters. */
 } wl_pkt_filter_list_t;
 
-#define WL_PKT_FILTER_LIST_FIXED_LEN      OFFSETOF(wl_pkt_filter_list_t, filter)
-
+#define WL_PKT_FILTER_LIST_FIXED_LEN	  OFFSETOF(wl_pkt_filter_list_t, filter)
 
+/* IOVAR "pkt_filter_stats" parameter. Used to retrieve debug statistics. */
 typedef struct wl_pkt_filter_stats {
-	uint32  num_pkts_matched;
-	uint32  num_pkts_forwarded;
-	uint32  num_pkts_discarded;
+	uint32	num_pkts_matched;	/* # filter matches for specified filter id */
+	uint32	num_pkts_forwarded;	/* # packets fwded from dongle to host for all filters */
+	uint32	num_pkts_discarded;	/* # packets discarded by dongle for all filters */
 } wl_pkt_filter_stats_t;
 
+#define RSN_KCK_LENGTH 16
+#define RSN_KEK_LENGTH 16
+#define RSN_REPLAY_LEN 8
+typedef struct _gtkrefresh {
+	uchar	KCK[RSN_KCK_LENGTH];
+	uchar	KEK[RSN_KEK_LENGTH];
+	uchar	ReplayCounter[RSN_REPLAY_LEN];
+} gtk_keyinfo_t, *pgtk_keyinfo_t;
 
+/* Sequential Commands ioctl */
 typedef struct wl_seq_cmd_ioctl {
-	uint32 cmd;
-	uint32 len;
+	uint32 cmd;		/* common ioctl definition */
+	uint32 len;		/* length of user buffer */
 } wl_seq_cmd_ioctl_t;
 
-#define WL_SEQ_CMD_ALIGN_BYTES  4
-
+#define WL_SEQ_CMD_ALIGN_BYTES	4
 
+/* These are the set of get IOCTLs that should be allowed when using
+ * IOCTL sequence commands. These are issued implicitly by wl.exe each time
+ * it is invoked. We never want to buffer these, or else wl.exe will stop working.
+ */
 #define WL_SEQ_CMDS_GET_IOCTL_FILTER(cmd) \
-	(((cmd) == WLC_GET_MAGIC) || \
-	 ((cmd) == WLC_GET_VERSION) || \
-	 ((cmd) == WLC_GET_AP) || \
+	(((cmd) == WLC_GET_MAGIC)		|| \
+	 ((cmd) == WLC_GET_VERSION)		|| \
+	 ((cmd) == WLC_GET_AP)			|| \
 	 ((cmd) == WLC_GET_INSTANCE))
 
+/*
+ * Packet engine interface
+ */
 
+#define WL_PKTENG_PER_TX_START			0x01
+#define WL_PKTENG_PER_TX_STOP			0x02
+#define WL_PKTENG_PER_RX_START			0x04
+#define WL_PKTENG_PER_RX_WITH_ACK_START 	0x05
+#define WL_PKTENG_PER_TX_WITH_ACK_START 	0x06
+#define WL_PKTENG_PER_RX_STOP			0x08
+#define WL_PKTENG_PER_MASK			0xff
 
-#define WL_PKTENG_PER_TX_START          0x01
-#define WL_PKTENG_PER_TX_STOP           0x02
-#define WL_PKTENG_PER_RX_START          0x04
-#define WL_PKTENG_PER_RX_WITH_ACK_START     0x05
-#define WL_PKTENG_PER_TX_WITH_ACK_START     0x06
-#define WL_PKTENG_PER_RX_STOP           0x08
-#define WL_PKTENG_PER_MASK          0xff
+#define WL_PKTENG_SYNCHRONOUS			0x100	/* synchronous flag */
 
-#define WL_PKTENG_SYNCHRONOUS           0x100
+#define WL_PKTENG_MAXPKTSZ			16384	/* max pktsz limit for pkteng */
 
 typedef struct wl_pkteng {
 	uint32 flags;
-	uint32 delay;
-	uint32 nframes;
-	uint32 length;
-	uint8  seqno;
-	struct ether_addr dest;
-	struct ether_addr src;
+	uint32 delay;			/* Inter-packet delay */
+	uint32 nframes;			/* Number of frames */
+	uint32 length;			/* Packet length */
+	uint8  seqno;			/* Enable/disable sequence no. */
+	struct ether_addr dest;		/* Destination address */
+	struct ether_addr src;		/* Source address */
 } wl_pkteng_t;
 
-#define NUM_80211b_RATES    4
-#define NUM_80211ag_RATES   8
-#define NUM_80211n_RATES    32
-#define NUM_80211_RATES     (NUM_80211b_RATES+NUM_80211ag_RATES+NUM_80211n_RATES)
+#define NUM_80211b_RATES	4
+#define NUM_80211ag_RATES	8
+#define NUM_80211n_RATES	32
+#define NUM_80211_RATES		(NUM_80211b_RATES+NUM_80211ag_RATES+NUM_80211n_RATES)
 typedef struct wl_pkteng_stats {
-	uint32 lostfrmcnt;
-	int32 rssi;
-	int32 snr;
+	uint32 lostfrmcnt;		/* RX PER test: no of frames lost (skip seqno) */
+	int32 rssi;			/* RSSI */
+	int32 snr;			/* signal to noise ratio */
 	uint16 rxpktcnt[NUM_80211_RATES+1];
+	uint8 rssi_qdb; /* qdB portion of the computed rssi */
 } wl_pkteng_stats_t;
 
 
-#define WL_WOWL_MAGIC   (1 << 0)
-#define WL_WOWL_NET (1 << 1)
-#define WL_WOWL_DIS (1 << 2)
-#define WL_WOWL_RETR    (1 << 3)
-#define WL_WOWL_BCN (1 << 4)
-#define WL_WOWL_TST (1 << 5)
-#define WL_WOWL_M1      (1 << 6)
-#define WL_WOWL_EAPID   (1 << 7)
-#define WL_WOWL_KEYROT  (1 << 14)
-#define WL_WOWL_BCAST   (1 << 15)
-
-#define MAGIC_PKT_MINLEN 102
+#define WL_WOWL_MAGIC       (1 << 0)    /* Wakeup on Magic packet */
+#define WL_WOWL_NET         (1 << 1)    /* Wakeup on Netpattern */
+#define WL_WOWL_DIS         (1 << 2)    /* Wakeup on loss-of-link due to Disassoc/Deauth */
+#define WL_WOWL_RETR        (1 << 3)    /* Wakeup on retrograde TSF */
+#define WL_WOWL_BCN         (1 << 4)    /* Wakeup on loss of beacon */
+#define WL_WOWL_TST         (1 << 5)    /* Wakeup after test */
+#define WL_WOWL_M1          (1 << 6)    /* Wakeup after PTK refresh */
+#define WL_WOWL_EAPID       (1 << 7)    /* Wakeup after receipt of EAP-Identity Req */
+#define WL_WOWL_PME_GPIO    (1 << 8)    /* Wakeind via PME(0) or GPIO(1) */
+#define WL_WOWL_NEEDTKIP1   (1 << 9)    /* need tkip phase 1 key to be updated by the driver */
+#define WL_WOWL_GTK_FAILURE (1 << 10)   /* enable wakeup if GTK fails */
+#define WL_WOWL_EXTMAGPAT   (1 << 11)   /* support extended magic packets */
+#define WL_WOWL_ARPOFFLOAD  (1 << 12)   /* support ARP/NS/keepalive offloading */
+#define WL_WOWL_WPA2        (1 << 13)   /* read protocol version for EAPOL frames */
+#define WL_WOWL_KEYROT      (1 << 14)   /* If the bit is set, use key rotaton */
+#define WL_WOWL_BCAST       (1 << 15)   /* If the bit is set, frm received was bcast frame */
+
+#define MAGIC_PKT_MINLEN 102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+
+#define WOWL_PATTEN_TYPE_ARP	(1 << 0)	/* ARP offload Pattern */
+#define WOWL_PATTEN_TYPE_NA	(1 << 1)	/* NA offload Pattern */
 
 typedef struct {
-	uint masksize;
-	uint offset;
-	uint patternoffset;
-	uint patternsize;
-	ulong id;
-
-
+	uint32 masksize;		/* Size of the mask in #of bytes */
+	uint32 offset;			/* Offset to start looking for the packet in # of bytes */
+	uint32 patternoffset;		/* Offset of start of pattern in the structure */
+	uint32 patternsize;		/* Size of the pattern itself in #of bytes */
+	uint32 id;			/* id */
+	uint32 reasonsize;		/* Size of the wakeup reason code */
+	uint32 flags;			/* Flags to tell the pattern type and other properties */
+	/* Mask follows the structure above */
+	/* Pattern follows the mask is at 'patternoffset' from the start */
 } wl_wowl_pattern_t;
 
 typedef struct {
-	uint            count;
-	wl_wowl_pattern_t   pattern[1];
+	uint			count;
+	wl_wowl_pattern_t	pattern[1];
 } wl_wowl_pattern_list_t;
 
 typedef struct {
-	uint8   pci_wakeind;
-	uint16  ucode_wakeind;
+	uint8	pci_wakeind;	/* Whether PCI PMECSR PMEStatus bit was set */
+	uint16	ucode_wakeind;	/* What wakeup-event indication was set by ucode */
 } wl_wowl_wakeind_t;
 
 
+/* per AC rate control related data structure */
 typedef struct wl_txrate_class {
-	uint8       init_rate;
-	uint8       min_rate;
-	uint8       max_rate;
+	uint8		init_rate;
+	uint8		min_rate;
+	uint8		max_rate;
 } wl_txrate_class_t;
 
 
 
-
-#define WLC_OBSS_SCAN_PASSIVE_DWELL_DEFAULT     20
-#define WLC_OBSS_SCAN_PASSIVE_DWELL_MIN         5
-#define WLC_OBSS_SCAN_PASSIVE_DWELL_MAX         1000
-#define WLC_OBSS_SCAN_ACTIVE_DWELL_DEFAULT      10
-#define WLC_OBSS_SCAN_ACTIVE_DWELL_MIN          10
-#define WLC_OBSS_SCAN_ACTIVE_DWELL_MAX          1000
-#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_DEFAULT    300
-#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MIN        10
-#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MAX        900
-#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_DEFAULT  5
-#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MIN  5
-#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MAX  100
-#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_DEFAULT 200
-#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MIN 200
-#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MAX 10000
-#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_DEFAULT  20
-#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MIN  20
-#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MAX  10000
-#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_DEFAULT    25
-#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MIN        0
-#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MAX        100
-
-
+/* Overlap BSS Scan parameters default, minimum, maximum */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_DEFAULT		20	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MIN			5	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MAX			1000	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_DEFAULT		10	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MIN			10	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MAX			1000	/* unit TU */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_DEFAULT	300	/* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MIN		10	/* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MAX		900	/* unit Sec */
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_DEFAULT	5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MIN	5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MAX	100
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_DEFAULT	200	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MIN	200	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MAX	10000	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_DEFAULT	20	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MIN	20	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MAX	10000	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_DEFAULT	25	/* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MIN		0	/* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MAX		100	/* unit percent */
+
+/* structure for Overlap BSS scan arguments */
 typedef struct wl_obss_scan_arg {
-	int16   passive_dwell;
-	int16   active_dwell;
-	int16   bss_widthscan_interval;
-	int16   passive_total;
-	int16   active_total;
-	int16   chanwidth_transition_delay;
-	int16   activity_threshold;
+	int16	passive_dwell;
+	int16	active_dwell;
+	int16	bss_widthscan_interval;
+	int16	passive_total;
+	int16	active_total;
+	int16	chanwidth_transition_delay;
+	int16	activity_threshold;
 } wl_obss_scan_arg_t;
 
-#define WL_OBSS_SCAN_PARAM_LEN  sizeof(wl_obss_scan_arg_t)
-#define WL_MIN_NUM_OBSS_SCAN_ARG 7
+#define WL_OBSS_SCAN_PARAM_LEN	sizeof(wl_obss_scan_arg_t)
+#define WL_MIN_NUM_OBSS_SCAN_ARG 7	/* minimum number of arguments required for OBSS Scan */
 
-#define WL_COEX_INFO_MASK       0x07
-#define WL_COEX_INFO_REQ        0x01
-#define WL_COEX_40MHZ_INTOLERANT    0x02
-#define WL_COEX_WIDTH20         0x04
+#define WL_COEX_INFO_MASK		0x07
+#define WL_COEX_INFO_REQ		0x01
+#define	WL_COEX_40MHZ_INTOLERANT	0x02
+#define	WL_COEX_WIDTH20			0x04
 
-#define WLC_RSSI_INVALID     0
+#define	WLC_RSSI_INVALID	 0	/* invalid RSSI value */
 
 #define MAX_RSSI_LEVELS 8
 
-
+/* RSSI event notification configuration. */
 typedef struct wl_rssi_event {
-	uint32 rate_limit_msec;
-	uint8 num_rssi_levels;
-	int8 rssi_levels[MAX_RSSI_LEVELS];
+	uint32 rate_limit_msec;		/* # of events posted to application will be limited to
+					 * one per specified period (0 to disable rate limit).
+					 */
+	uint8 num_rssi_levels;		/* Number of entries in rssi_levels[] below */
+	int8 rssi_levels[MAX_RSSI_LEVELS];	/* Variable number of RSSI levels. An event
+						 * will be posted each time the RSSI of received
+						 * beacons/packets crosses a level.
+						 */
 } wl_rssi_event_t;
 
 typedef struct wl_action_obss_coex_req {
@@ -2438,36 +4364,137 @@ typedef struct wl_action_obss_coex_req {
 } wl_action_obss_coex_req_t;
 
 
-#define EXTLOG_CUR_VER      0x0100
+/* IOVar parameter block for small MAC address array with type indicator */
+#define WL_IOV_MAC_PARAM_LEN  4
+
+#define WL_IOV_PKTQ_LOG_PRECS 16
+
+typedef struct {
+	uint32 num_addrs;
+	char   addr_type[WL_IOV_MAC_PARAM_LEN];
+	struct ether_addr ea[WL_IOV_MAC_PARAM_LEN];
+} wl_iov_mac_params_t;
+
+
+/* Parameter block for PKTQ_LOG statistics */
+typedef struct {
+	uint32 requested;      /* packets requested to be stored */
+	uint32 stored;         /* packets stored */
+	uint32 saved;          /* packets saved,
+	                          because a lowest priority queue has given away one packet
+	                       */
+	uint32 selfsaved;      /* packets saved,
+	                          because an older packet from the same queue has been dropped
+	                       */
+	uint32 full_dropped;   /* packets dropped,
+	                          because pktq is full with higher precedence packets
+	                       */
+	uint32 dropped;        /* packets dropped because pktq per that precedence is full */
+	uint32 sacrificed;     /* packets dropped,
+	                          in order to save one from a queue of a highest priority
+	                       */
+	uint32 busy;           /* packets droped because of hardware/transmission error */
+	uint32 retry;          /* packets re-sent because they were not received */
+	uint32 ps_retry;       /* packets retried again prior to moving power save mode */
+	uint32 retry_drop;     /* packets finally dropped after retry limit */
+	uint32 max_avail;      /* the high-water mark of the queue capacity for packets -
+	                          goes to zero as queue fills
+	                       */
+	uint32 max_used;       /* the high-water mark of the queue utilisation for packets -
+	                          increases with use ('inverse' of max_avail)
+	                       */
+	uint32 queue_capacity; /* the maximum capacity of the queue */
+} pktq_log_counters_v01_t;
+
+typedef struct {
+	uint32 requested;      /* packets requested to be stored */
+	uint32 stored;         /* packets stored */
+	uint32 saved;          /* packets saved,
+	                          because a lowest priority queue has given away one packet
+	                       */
+	uint32 selfsaved;      /* packets saved,
+	                          because an older packet from the same queue has been dropped
+	                       */
+	uint32 full_dropped;   /* packets dropped,
+	                          because pktq is full with higher precedence packets
+	                       */
+	uint32 dropped;        /* packets dropped because pktq per that precedence is full */
+	uint32 sacrificed;     /* packets dropped,
+	                          in order to save one from a queue of a highest priority
+	                       */
+	uint32 busy;           /* packets droped because of hardware/transmission error */
+	uint32 retry;          /* packets re-sent because they were not received */
+	uint32 ps_retry;       /* packets retried again prior to moving power save mode */
+	uint32 retry_drop;     /* packets finally dropped after retry limit */
+	uint32 max_avail;      /* the high-water mark of the queue capacity for packets -
+	                          goes to zero as queue fills
+	                       */
+	uint32 max_used;       /* the high-water mark of the queue utilisation for packets -
+	                          increases with use ('inverse' of max_avail)
+	                       */
+	uint32 queue_capacity; /* the maximum capacity of the queue */
+	uint32 rtsfail;        /* count of rts attempts that failed to receive cts */
+	uint32 acked;          /* count of packets sent (acked) successfully */
+} pktq_log_counters_v02_t;
+
+#define sacrified sacrificed
+
+typedef struct {
+	uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+	pktq_log_counters_v01_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+	char                 headings[1];
+} pktq_log_format_v01_t;
+
+typedef struct {
+	uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+	pktq_log_counters_v02_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+	uint32               throughput[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+	uint32               time_delta;
+	char                 headings[1];
+} pktq_log_format_v02_t;
 
-#define MAX_ARGSTR_LEN      18
 
+typedef struct {
+	uint32               version;
+	wl_iov_mac_params_t  params;
+	union {
+		pktq_log_format_v01_t v01;
+		pktq_log_format_v02_t v02;
+	} pktq_log;
+} wl_iov_pktq_log_t;
 
-#define LOG_MODULE_COMMON   0x0001
-#define LOG_MODULE_ASSOC    0x0002
-#define LOG_MODULE_EVENT    0x0004
-#define LOG_MODULE_MAX      3
 
+/* **** EXTLOG **** */
+#define EXTLOG_CUR_VER		0x0100
 
-#define WL_LOG_LEVEL_DISABLE    0
-#define WL_LOG_LEVEL_ERR    1
-#define WL_LOG_LEVEL_WARN   2
-#define WL_LOG_LEVEL_INFO   3
-#define WL_LOG_LEVEL_MAX    WL_LOG_LEVEL_INFO
+#define MAX_ARGSTR_LEN		18 /* At least big enough for storing ETHER_ADDR_STR_LEN */
 
+/* log modules (bitmap) */
+#define LOG_MODULE_COMMON	0x0001
+#define LOG_MODULE_ASSOC	0x0002
+#define LOG_MODULE_EVENT	0x0004
+#define LOG_MODULE_MAX		3			/* Update when adding module */
 
-#define LOG_FLAG_EVENT      1
+/* log levels */
+#define WL_LOG_LEVEL_DISABLE	0
+#define WL_LOG_LEVEL_ERR	1
+#define WL_LOG_LEVEL_WARN	2
+#define WL_LOG_LEVEL_INFO	3
+#define WL_LOG_LEVEL_MAX	WL_LOG_LEVEL_INFO	/* Update when adding level */
 
+/* flag */
+#define LOG_FLAG_EVENT		1
 
-#define LOG_ARGTYPE_NULL    0
-#define LOG_ARGTYPE_STR     1
-#define LOG_ARGTYPE_INT     2
-#define LOG_ARGTYPE_INT_STR 3
-#define LOG_ARGTYPE_STR_INT 4
+/* log arg_type */
+#define LOG_ARGTYPE_NULL	0
+#define LOG_ARGTYPE_STR		1	/* %s */
+#define LOG_ARGTYPE_INT		2	/* %d */
+#define LOG_ARGTYPE_INT_STR	3	/* %d...%s */
+#define LOG_ARGTYPE_STR_INT	4	/* %s...%d */
 
 typedef struct wlc_extlog_cfg {
 	int max_number;
-	uint16 module;
+	uint16 module;	/* bitmap */
 	uint8 level;
 	uint8 flag;
 	uint16 version;
@@ -2497,15 +4524,18 @@ typedef struct wlc_extlog_results {
 } wlc_extlog_results_t;
 
 typedef struct log_idstr {
-	uint16  id;
-	uint16  flag;
-	uint8   arg_type;
-	const char  *fmt_str;
+	uint16	id;
+	uint16	flag;
+	uint8	arg_type;
+	const char	*fmt_str;
 } log_idstr_t;
 
-#define FMTSTRF_USER        1
-
+#define FMTSTRF_USER		1
 
+/* flat ID definitions
+ * New definitions HAVE TO BE ADDED at the end of the table. Otherwise, it will
+ * affect backward compatibility with pre-existing apps
+ */
 typedef enum {
 	FMTSTR_DRIVER_UP_ID = 0,
 	FMTSTR_DRIVER_DOWN_ID = 1,
@@ -2542,62 +4572,112 @@ typedef enum {
 
 #ifdef DONGLEOVERLAYS
 typedef struct {
-	uint32 flags_idx;
-	uint32 offset;
-	uint32 len;
-
+	uint32 flags_idx;	/* lower 8 bits: overlay index; upper 24 bits: flags */
+	uint32 offset;		/* offset into overlay region to write code */
+	uint32 len;			/* overlay code len */
+	/* overlay code follows this struct */
 } wl_ioctl_overlay_t;
 
 #define OVERLAY_IDX_MASK		0x000000ff
 #define OVERLAY_IDX_SHIFT		0
 #define OVERLAY_FLAGS_MASK		0xffffff00
 #define OVERLAY_FLAGS_SHIFT		8
-
+/* overlay written to device memory immediately after loading the base image */
 #define OVERLAY_FLAG_POSTLOAD	0x100
-
+/* defer overlay download until the device responds w/WLC_E_OVL_DOWNLOAD event */
 #define OVERLAY_FLAG_DEFER_DL	0x200
-
+/* overlay downloaded prior to the host going to sleep */
 #define OVERLAY_FLAG_PRESLEEP	0x400
 
 #define OVERLAY_DOWNLOAD_CHUNKSIZE	1024
-#endif
+#endif /* DONGLEOVERLAYS */
 
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
 
+/* no default structure packing */
 #include <packed_section_end.h>
 
-
+/* require strict packing */
 #include <packed_section_start.h>
 
-#define VNDR_IE_CMD_LEN     4
-
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
 
-#define VNDR_IE_BEACON_FLAG 0x1
-#define VNDR_IE_PRBRSP_FLAG 0x2
-#define VNDR_IE_ASSOCRSP_FLAG   0x4
-#define VNDR_IE_AUTHRSP_FLAG    0x8
-#define VNDR_IE_PRBREQ_FLAG 0x10
-#define VNDR_IE_ASSOCREQ_FLAG   0x20
-#define VNDR_IE_CUSTOM_FLAG 0x100
+/* Structures and constants used for "vndr_ie" IOVar interface */
+#define VNDR_IE_CMD_LEN		4	/* length of the set command string:
+					 * "add", "del" (+ NUL)
+					 */
 
-#define VNDR_IE_INFO_HDR_LEN    (sizeof(uint32))
+/* 802.11 Mgmt Packet flags */
+#define VNDR_IE_BEACON_FLAG	0x1
+#define VNDR_IE_PRBRSP_FLAG	0x2
+#define VNDR_IE_ASSOCRSP_FLAG	0x4
+#define VNDR_IE_AUTHRSP_FLAG	0x8
+#define VNDR_IE_PRBREQ_FLAG	0x10
+#define VNDR_IE_ASSOCREQ_FLAG	0x20
+#define VNDR_IE_IWAPID_FLAG	0x40 /* vendor IE in IW advertisement protocol ID field */
+#define VNDR_IE_CUSTOM_FLAG	0x100 /* allow custom IE id */
+
+#if defined(WLP2P)
+/* P2P Action Frames flags (spec ordered) */
+#define VNDR_IE_GONREQ_FLAG     0x001000
+#define VNDR_IE_GONRSP_FLAG     0x002000
+#define VNDR_IE_GONCFM_FLAG     0x004000
+#define VNDR_IE_INVREQ_FLAG     0x008000
+#define VNDR_IE_INVRSP_FLAG     0x010000
+#define VNDR_IE_DISREQ_FLAG     0x020000
+#define VNDR_IE_DISRSP_FLAG     0x040000
+#define VNDR_IE_PRDREQ_FLAG     0x080000
+#define VNDR_IE_PRDRSP_FLAG     0x100000
+
+#define VNDR_IE_P2PAF_SHIFT	12
+#endif /* WLP2P */
+
+#define VNDR_IE_INFO_HDR_LEN	(sizeof(uint32))
 
 typedef BWL_PRE_PACKED_STRUCT struct {
-	uint32 pktflag;
-	vndr_ie_t vndr_ie_data;
+	uint32 pktflag;			/* bitmask indicating which packet(s) contain this IE */
+	vndr_ie_t vndr_ie_data;		/* vendor IE data */
 } BWL_POST_PACKED_STRUCT vndr_ie_info_t;
 
 typedef BWL_PRE_PACKED_STRUCT struct {
-	int iecount;
-	vndr_ie_info_t vndr_ie_list[1];
+	int iecount;			/* number of entries in the vndr_ie_list[] array */
+	vndr_ie_info_t vndr_ie_list[1];	/* variable size list of vndr_ie_info_t structs */
 } BWL_POST_PACKED_STRUCT vndr_ie_buf_t;
 
 typedef BWL_PRE_PACKED_STRUCT struct {
-	char cmd[VNDR_IE_CMD_LEN];
-	vndr_ie_buf_t vndr_ie_buffer;
+	char cmd[VNDR_IE_CMD_LEN];	/* vndr_ie IOVar set command : "add", "del" + NUL */
+	vndr_ie_buf_t vndr_ie_buffer;	/* buffer containing Vendor IE list information */
 } BWL_POST_PACKED_STRUCT vndr_ie_setbuf_t;
 
+/* tag_ID/length/value_buffer tuple */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8	id;
+	uint8	len;
+	uint8	data[1];
+} BWL_POST_PACKED_STRUCT tlv_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 pktflag;			/* bitmask indicating which packet(s) contain this IE */
+	tlv_t ie_data;		/* IE data */
+} BWL_POST_PACKED_STRUCT ie_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	int iecount;			/* number of entries in the ie_list[] array */
+	ie_info_t ie_list[1];	/* variable size list of ie_info_t structs */
+} BWL_POST_PACKED_STRUCT ie_buf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	char cmd[VNDR_IE_CMD_LEN];	/* ie IOVar set command : "add" + NUL */
+	ie_buf_t ie_buffer;	/* buffer containing IE list information */
+} BWL_POST_PACKED_STRUCT ie_setbuf_t;
 
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 pktflag;		/* bitmask indicating which packet(s) contain this IE */
+	uint8 id;		/* IE type */
+} BWL_POST_PACKED_STRUCT ie_getbuf_t;
 
+/* structures used to define format of wps ie data from probe requests */
+/* passed up to applications via iovar "prbreq_wpsie" */
 typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_hdr {
 	struct ether_addr staAddr;
 	uint16 ieLen;
@@ -2616,21 +4696,54 @@ typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_list {
 
 #ifdef WLMEDIA_TXFAILEVENT
 typedef BWL_PRE_PACKED_STRUCT struct {
-	char   dest[ETHER_ADDR_LEN];
-	uint8  prio;
-	uint8  flags;
-	uint32 tsf_l;
-	uint32 tsf_h;
-	uint16 rates;
-	uint16 txstatus;
+	char   dest[ETHER_ADDR_LEN]; /* destination MAC */
+	uint8  prio;            /* Packet Priority */
+	uint8  flags;           /* Flags           */
+	uint32 tsf_l;           /* TSF timer low   */
+	uint32 tsf_h;           /* TSF timer high  */
+	uint16 rates;           /* Main Rates      */
+	uint16 txstatus;        /* TX Status       */
 } BWL_POST_PACKED_STRUCT txfailinfo_t;
-#endif
+#endif /* WLMEDIA_TXFAILEVENT */
 
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 flags;
+	chanspec_t chanspec;			/* txpwr report for this channel */
+	chanspec_t local_chanspec;		/* channel on which we are associated */
+	uint8 local_max;			/* local max according to the AP */
+	uint8 local_constraint;			/* local constraint according to the AP */
+	int8  antgain[2];			/* Ant gain for each band - from SROM */
+	uint8 rf_cores;				/* count of RF Cores being reported */
+	uint8 est_Pout[4];			/* Latest tx power out estimate per RF chain */
+	uint8 est_Pout_act[4]; /* Latest tx power out estimate per RF chain w/o adjustment */
+	uint8 est_Pout_cck;			/* Latest CCK tx power out estimate */
+	uint8 tx_power_max[4];		/* Maximum target power among all rates */
+	uint tx_power_max_rate_ind[4];		/* Index of the rate with the max target power */
+	int8 clm_limits[WL_NUMRATES];		/* regulatory limits - 20, 40 or 80MHz */
+	int8 clm_limits_subchan1[WL_NUMRATES];	/* regulatory limits - 20in40 or 40in80 */
+	int8 clm_limits_subchan2[WL_NUMRATES];	/* regulatory limits - 20in80MHz */
+	int8 sar;					/* SAR limit for display by wl executable */
+	int8 channel_bandwidth;		/* 20, 40 or 80 MHz bandwidth? */
+	uint8 version;				/* Version of the data format wlu <--> driver */
+	uint8 display_core;			/* Displayed curpower core */
+	int8 target_offsets[4];		/* Target power offsets for current rate per core */
+	uint32 last_tx_ratespec;	/* Ratespec for last transmition */
+	uint   user_target;		/* user limit */
+	uint32 board_limit_len;		/* length of board limit buffer */
+	uint32 target_len;		/* length of target power buffer */
+	int8 SARLIMIT[MAX_STREAMS_SUPPORTED];
+	uint8  pprdata[1];		/* ppr serialization buffer */
+} BWL_POST_PACKED_STRUCT tx_pwr_rpt_t;
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* no strict structure packing */
 #include <packed_section_end.h>
 
-
-#define ASSERTLOG_CUR_VER   0x0100
-#define MAX_ASSRTSTR_LEN    64
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* Global ASSERT Logging */
+#define ASSERTLOG_CUR_VER	0x0100
+#define MAX_ASSRTSTR_LEN	64
 
 typedef struct assert_record {
 	uint32 time;
@@ -2645,32 +4758,49 @@ typedef struct assertlog_results {
 	assert_record_t logs[1];
 } assertlog_results_t;
 
-#define LOGRRC_FIX_LEN  8
+#define LOGRRC_FIX_LEN	8
 #define IOBUF_ALLOWED_NUM_OF_LOGREC(type, len) ((len - LOGRRC_FIX_LEN)/sizeof(type))
 
 
-
-
-
-#define CHANIM_DISABLE  0
-#define CHANIM_DETECT   1
-#define CHANIM_ACT  2
-#define CHANIM_MODE_MAX 2
-
-
-#define APCS_IOCTL      1
-#define APCS_CHANIM     2
-#define APCS_CSTIMER    3
-#define APCS_BTA        4
-
-
-#define CHANIM_ACS_RECORD           10
-
-
+/* channel interference measurement (chanim) related defines */
+
+/* chanim mode */
+#define CHANIM_DISABLE	0	/* disabled */
+#define CHANIM_DETECT	1	/* detection only */
+#define CHANIM_EXT		2 	/* external state machine */
+#define CHANIM_ACT		3	/* full internal state machine, detect + act */
+#define CHANIM_MODE_MAX 4
+
+/* define for apcs reason code */
+#define APCS_INIT		0
+#define APCS_IOCTL		1
+#define APCS_CHANIM		2
+#define APCS_CSTIMER	3
+#define APCS_BTA		4
+#define APCS_TXDLY		5
+#define APCS_NONACSD	6
+
+/* number of ACS record entries */
+#define CHANIM_ACS_RECORD			10
+
+/* CHANIM */
+#define CCASTATS_TXDUR  0
+#define CCASTATS_INBSS  1
+#define CCASTATS_OBSS   2
+#define CCASTATS_NOCTG  3
+#define CCASTATS_NOPKT  4
+#define CCASTATS_DOZE   5
+#define CCASTATS_TXOP	6
+#define CCASTATS_GDTXDUR        7
+#define CCASTATS_BDTXDUR        8
+#define CCASTATS_MAX    9
+
+/* chanim acs record */
 typedef struct {
 	bool valid;
 	uint8 trigger;
 	chanspec_t selected_chspc;
+	int8 bgnoise;
 	uint32 glitch_cnt;
 	uint8 ccastats;
 	uint timestamp;
@@ -2682,23 +4812,69 @@ typedef struct {
 	uint timestamp;
 } wl_acs_record_t;
 
+typedef struct chanim_stats {
+	uint32 glitchcnt;               /* normalized as per second count */
+	uint32 badplcp;                 /* normalized as per second count */
+	uint8 ccastats[CCASTATS_MAX]; 	/* normalized as 0-255 */
+	int8 bgnoise;					/* background noise level (in dBm) */
+	chanspec_t chanspec;
+	uint32 timestamp;
+} chanim_stats_t;
 
+#define WL_CHANIM_STATS_VERSION 1
+#define WL_CHANIM_COUNT_ALL	0xff
+#define WL_CHANIM_COUNT_ONE	0x1
 
-#define SMFS_VERSION 1
+typedef struct {
+	uint32 buflen;
+	uint32 version;
+	uint32 count;
+	chanim_stats_t stats[1];
+} wl_chanim_stats_t;
 
+#define WL_CHANIM_STATS_FIXED_LEN OFFSETOF(wl_chanim_stats_t, stats)
+
+/* Noise measurement metrics. */
+#define NOISE_MEASURE_KNOISE	0x1
+
+/* scb probe parameter */
+typedef struct {
+	uint32 scb_timeout;
+	uint32 scb_activity_time;
+	uint32 scb_max_probe;
+} wl_scb_probe_t;
+
+/* ap tpc modes */
+#define	AP_TPC_OFF		0
+#define	AP_TPC_BSS_PWR		1	/* BSS power control */
+#define AP_TPC_AP_PWR		2	/* AP power control */
+#define	AP_TPC_AP_BSS_PWR	3	/* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN	127
+
+/* ap tpc modes */
+#define	AP_TPC_OFF		0
+#define	AP_TPC_BSS_PWR		1	/* BSS power control */
+#define AP_TPC_AP_PWR		2	/* AP power control */
+#define	AP_TPC_AP_BSS_PWR	3	/* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN	127
+
+/* structure/defines for selective mgmt frame (smf) stats support */
+
+#define SMFS_VERSION 1
+/* selected mgmt frame (smf) stats element */
 typedef struct wl_smfs_elem {
 	uint32 count;
-	uint16 code;
+	uint16 code;  /* SC or RC code */
 } wl_smfs_elem_t;
 
 typedef struct wl_smf_stats {
 	uint32 version;
-	uint16 length;
+	uint16 length;	/* reserved for future usage */
 	uint8 type;
 	uint8 codetype;
 	uint32 ignored_cnt;
 	uint32 malformed_cnt;
-	uint32 count_total;
+	uint32 count_total; /* count included the interested group */
 	wl_smfs_elem_t elem[1];
 } wl_smf_stats_t;
 
@@ -2709,9 +4885,9 @@ enum {
 	SMFS_CODETYPE_RC
 };
 
-
-#define SMFS_CODE_MALFORMED 0xFFFE
-#define SMFS_CODE_IGNORED   0xFFFD
+/* reuse two number in the sc/rc space */
+#define	SMFS_CODE_MALFORMED 0xFFFE
+#define SMFS_CODE_IGNORED 	0xFFFD
 
 typedef enum smfs_type {
 	SMFS_TYPE_AUTH,
@@ -2729,7 +4905,7 @@ typedef enum smfs_type {
 #define PHYMON_VERSION 1
 
 typedef struct wl_phycal_core_state {
-
+	/* Tx IQ/LO calibration coeffs */
 	int16 tx_iqlocal_a;
 	int16 tx_iqlocal_b;
 	int8 tx_iqlocal_ci;
@@ -2741,19 +4917,19 @@ typedef struct wl_phycal_core_state {
 	int8 tx_iqlocal_fi;
 	int8 tx_iqlocal_fq;
 
-
+	/* Rx IQ calibration coeffs */
 	int16 rx_iqcal_a;
 	int16 rx_iqcal_b;
 
-	uint8 tx_iqlocal_pwridx;
-	uint32 papd_epsilon_table[64];
-	int16 papd_epsilon_offset;
-	uint8 curr_tx_pwrindex;
-	int8 idle_tssi;
-	int8 est_tx_pwr;
-	int8 est_rx_pwr;
-	uint16 rx_gaininfo;
-	uint16 init_gaincode;
+	uint8 tx_iqlocal_pwridx; /* Tx Power Index for Tx IQ/LO calibration */
+	uint32 papd_epsilon_table[64]; /* PAPD epsilon table */
+	int16 papd_epsilon_offset; /* PAPD epsilon offset */
+	uint8 curr_tx_pwrindex; /* Tx power index */
+	int8 idle_tssi; /* Idle TSSI */
+	int8 est_tx_pwr; /* Estimated Tx Power (dB) */
+	int8 est_rx_pwr; /* Estimated Rx Power (dB) from RSSI */
+	uint16 rx_gaininfo; /* Rx gain applied on last Rx pkt */
+	uint16 init_gaincode; /* initgain required for ACI */
 	int8 estirr_tx;
 	int8 estirr_rx;
 
@@ -2761,187 +4937,304 @@ typedef struct wl_phycal_core_state {
 
 typedef struct wl_phycal_state {
 	int version;
-	int8 num_phy_cores;
-	int8 curr_temperature;
-	chanspec_t chspec;
-	bool aci_state;
-	uint16 crsminpower;
-	uint16 crsminpowerl;
-	uint16 crsminpoweru;
+	int8 num_phy_cores; /* number of cores */
+	int8 curr_temperature; /* on-chip temperature sensor reading */
+	chanspec_t chspec; /* channspec for this state */
+	bool aci_state; /* ACI state: ON/OFF */
+	uint16 crsminpower; /* crsminpower required for ACI */
+	uint16 crsminpowerl; /* crsminpowerl required for ACI */
+	uint16 crsminpoweru; /* crsminpoweru required for ACI */
 	wl_phycal_core_state_t phycal_core[1];
 } wl_phycal_state_t;
 
 #define WL_PHYCAL_STAT_FIXED_LEN OFFSETOF(wl_phycal_state_t, phycal_core)
-#endif
-
-#ifdef WLP2P
+#endif /* PHYMON */
 
+/* discovery state */
 typedef struct wl_p2p_disc_st {
-	uint8 state;
-	chanspec_t chspec;
-	uint16 dwell;
+	uint8 state;	/* see state */
+	chanspec_t chspec;	/* valid in listen state */
+	uint16 dwell;	/* valid in listen state, in ms */
 } wl_p2p_disc_st_t;
 
+/* state */
+#define WL_P2P_DISC_ST_SCAN	0
+#define WL_P2P_DISC_ST_LISTEN	1
+#define WL_P2P_DISC_ST_SEARCH	2
 
-#define WL_P2P_DISC_ST_SCAN 0
-#define WL_P2P_DISC_ST_LISTEN   1
-#define WL_P2P_DISC_ST_SEARCH   2
-
-
+/* scan request */
 typedef struct wl_p2p_scan {
-	uint8 type;
+	uint8 type;		/* 'S' for WLC_SCAN, 'E' for "escan" */
 	uint8 reserved[3];
-
+	/* scan or escan parms... */
 } wl_p2p_scan_t;
 
-
+/* i/f request */
 typedef struct wl_p2p_if {
 	struct ether_addr addr;
-	uint8 type;
-	chanspec_t chspec;
+	uint8 type;	/* see i/f type */
+	chanspec_t chspec;	/* for p2p_ifadd GO */
 } wl_p2p_if_t;
 
+/* i/f type */
+#define WL_P2P_IF_CLIENT	0
+#define WL_P2P_IF_GO		1
+#define WL_P2P_IF_DYNBCN_GO	2
+#define WL_P2P_IF_DEV		3
 
-#define WL_P2P_IF_CLIENT    0
-#define WL_P2P_IF_GO        1
-#define WL_P2P_IF_DYNBCN_GO     2
-#define WL_P2P_IF_DEV       3
-
-
+/* i/f query */
 typedef struct wl_p2p_ifq {
 	uint bsscfgidx;
 	char ifname[BCM_MSG_IFNAME_MAX];
 } wl_p2p_ifq_t;
 
-
+/* OppPS & CTWindow */
 typedef struct wl_p2p_ops {
-	uint8 ops;
-	uint8 ctw;
+	uint8 ops;	/* 0: disable 1: enable */
+	uint8 ctw;	/* >= 10 */
 } wl_p2p_ops_t;
 
-
+/* absence and presence request */
 typedef struct wl_p2p_sched_desc {
 	uint32 start;
 	uint32 interval;
 	uint32 duration;
-	uint32 count;
+	uint32 count;	/* see count */
 } wl_p2p_sched_desc_t;
 
-
-#define WL_P2P_SCHED_RSVD   0
-#define WL_P2P_SCHED_REPEAT 255
+/* count */
+#define WL_P2P_SCHED_RSVD	0
+#define WL_P2P_SCHED_REPEAT	255	/* anything > 255 will be treated as 255 */
 
 typedef struct wl_p2p_sched {
-	uint8 type;
-	uint8 action;
-	uint8 option;
+	uint8 type;	/* see schedule type */
+	uint8 action;	/* see schedule action */
+	uint8 option;	/* see schedule option */
 	wl_p2p_sched_desc_t desc[1];
 } wl_p2p_sched_t;
-#define WL_P2P_SCHED_FIXED_LEN      3
-
-
-#define WL_P2P_SCHED_TYPE_ABS       0
-#define WL_P2P_SCHED_TYPE_REQ_ABS   1
-
-
-#define WL_P2P_SCHED_ACTION_NONE    0
-#define WL_P2P_SCHED_ACTION_DOZE    1
-
-#define WL_P2P_SCHED_ACTION_GOOFF   2
-
-#define WL_P2P_SCHED_ACTION_RESET   255
-
-
-#define WL_P2P_SCHED_OPTION_NORMAL  0
-#define WL_P2P_SCHED_OPTION_BCNPCT  1
-
-#define WL_P2P_SCHED_OPTION_TSFOFS  2
+#define WL_P2P_SCHED_FIXED_LEN		3
+
+/* schedule type */
+#define WL_P2P_SCHED_TYPE_ABS		0	/* Scheduled Absence */
+#define WL_P2P_SCHED_TYPE_REQ_ABS	1	/* Requested Absence */
+
+/* schedule action during absence periods (for WL_P2P_SCHED_ABS type) */
+#define WL_P2P_SCHED_ACTION_NONE	0	/* no action */
+#define WL_P2P_SCHED_ACTION_DOZE	1	/* doze */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_ACTION_GOOFF	2	/* turn off GO beacon/prbrsp functions */
+/* schedule option - WL_P2P_SCHED_TYPE_XXX */
+#define WL_P2P_SCHED_ACTION_RESET	255	/* reset */
+
+/* schedule option - WL_P2P_SCHED_TYPE_ABS */
+#define WL_P2P_SCHED_OPTION_NORMAL	0	/* normal start/interval/duration/count */
+#define WL_P2P_SCHED_OPTION_BCNPCT	1	/* percentage of beacon interval */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_OPTION_TSFOFS	2	/* normal start/internal/duration/count with
+						 * start being an offset of the 'current' TSF
+						 */
 
+/* feature flags */
+#define WL_P2P_FEAT_GO_CSA	(1 << 0)	/* GO moves with the STA using CSA method */
+#define WL_P2P_FEAT_GO_NOLEGACY	(1 << 1)	/* GO does not probe respond to non-p2p probe
+						 * requests
+						 */
+#define WL_P2P_FEAT_RESTRICT_DEV_RESP (1 << 2)	/* Restrict p2p dev interface from responding */
 
-#define WL_P2P_FEAT_GO_CSA      (1 << 0)
-#define WL_P2P_FEAT_GO_NOLEGACY (1 << 1)
-#define WL_P2P_FEAT_RESTRICT_DEV_RESP (1 << 2)
-#endif
+#ifdef WLNIC
+/* nic_cnx iovar */
+typedef struct wl_nic_cnx {
+	uint8 opcode;
+	struct ether_addr addr;
+	/* the following are valid for WL_NIC_CNX_CONN */
+	uint8 SSID_len;
+	uint8 SSID[32];
+	struct ether_addr abssid;
+	uint16 beacon_interval;
+	uint16 sync_threshold;
+	uint16 beacon_wait_time;
+} wl_nic_cnx_t;
+
+/* opcode */
+#define WL_NIC_CNX_ADD	0	/* add NIC connection */
+#define WL_NIC_CNX_DEL	1	/* delete NIC connection */
+#define WL_NIC_CNX_IDX	2	/* query NIC connection index */
+#define WL_NIC_CNX_CONN	3	/* join/create network */
+#define WL_NIC_CNX_DIS	4	/* disconnect from network */
+
+/* nic_cfg iovar */
+typedef struct wl_nic_cfg {
+	uint8 version;
+	uint8 beacon_mode;
+	uint8 diluted_beacon_period;
+	uint8 beacon_probability;
+	uint8 num_awake_window_params;
+	struct {
+		uint8 channel_number;
+		uint8 awake_window_length;
+		uint8 repeat_EQC;
+	} awake_window_params[3];
+	uint8 scan_length;
+	uint8 scan_interval;
+	uint8 scan_probability;
+	uint8 ASID;
+	uint8 channel_usage_mode;
+	uint8 CWmin_af;
+	uint8 NIC_priority;
+	uint8 NIC_data_ind;
+	uint8 allowed_wakeup_delay;
+} wl_nic_cfg_t;
+
+/* version */
+#define WL_NIC_CFG_VER	1
+
+/* beacon_mode */
+#define WL_NIC_BCN_NORM		0
+#define WL_NIC_BCN_DILUTED	1
+
+/* channel_usage_mode */
+#define WL_NIC_CHAN_STATIC	0
+#define WL_NIC_CHAN_CYCLE	1
+
+/* nic_cfg iovar */
+typedef struct wl_nic_frm {
+	uint8 type;
+	struct ether_addr da;
+	uint8 body[1];
+} wl_nic_frm_t;
 
+/* type */
+#define WL_NIC_FRM_ACTION	2
 
-#define BCM_ACTION_RFAWARE      0x77
+/* i/f query */
+typedef struct wl_nic_ifq {
+	uint bsscfgidx;
+	char ifname[BCM_MSG_IFNAME_MAX];
+} wl_nic_ifq_t;
+
+/* data mode */
+/* nic_dm iovar */
+typedef struct wl_nic_dm {
+	uint8 enab;
+	uint8 rsvd;
+	/* the following fields are valid when enabling... */
+	chanspec_t chspec;
+	uint8 DATA_priority;
+	uint8 NIC_priority;
+} wl_nic_dm_t;
+
+/* immediate scan request */
+typedef struct wl_nic_isq {
+	uint8 scan_length;
+} wl_nic_isq_t;
+#endif /* WLNIC */
+
+/* RFAWARE def */
+#define BCM_ACTION_RFAWARE		0x77
 #define BCM_ACTION_RFAWARE_DCS  0x01
 
+/* DCS reason code define */
+#define BCM_DCS_IOVAR		0x1
+#define BCM_DCS_UNKNOWN		0xFF
 
+typedef struct wl_bcmdcs_data {
+	uint reason;
+	chanspec_t chspec;
+} wl_bcmdcs_data_t;
 
-#define WL_11N_2x2          1
-#define WL_11N_3x3          3
-#define WL_11N_4x4          4
-
-
-#define WLFEATURE_DISABLE_11N       0x00000001
-#define WLFEATURE_DISABLE_11N_STBC_TX   0x00000002
-#define WLFEATURE_DISABLE_11N_STBC_RX   0x00000004
-#define WLFEATURE_DISABLE_11N_SGI_TX    0x00000008
-#define WLFEATURE_DISABLE_11N_SGI_RX    0x00000010
-#define WLFEATURE_DISABLE_11N_AMPDU_TX  0x00000020
-#define WLFEATURE_DISABLE_11N_AMPDU_RX  0x00000040
-#define WLFEATURE_DISABLE_11N_GF    0x00000080
-
-
-#define LQ_IDX_LAST             3
-#define MCS_INDEX_SIZE          33
-
-#define LQ_IDX_MIN              0
-#define LQ_IDX_MAX              1
-#define LQ_IDX_AVG              2
-#define LQ_IDX_SUM              2
-#define LQ_IDX_LAST             3
-#define LQ_STOP_MONITOR         0
-#define LQ_START_MONITOR        1
-
-#define LINKQUAL_V1     0x01
-
-struct  wl_lq {
-	int32 enable;
-	int32 rssi[LQ_IDX_LAST];
-	int32 rssicnt;
-	int32 snr[LQ_IDX_LAST];
-	uint32 nsamples;
-	uint8 isvalid;
-	uint8 version;
-};
-
-typedef struct wl_lq wl_lq_t;
-typedef struct wl_lq  wl_lq_stats_t;
-
+/* n-mode support capability */
+/* 2x2 includes both 1x1 & 2x2 devices
+ * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
+ * control it independently
+ */
+#define WL_11N_2x2			1
+#define WL_11N_3x3			3
+#define WL_11N_4x4			4
+
+/* define 11n feature disable flags */
+#define WLFEATURE_DISABLE_11N		0x00000001
+#define WLFEATURE_DISABLE_11N_STBC_TX	0x00000002
+#define WLFEATURE_DISABLE_11N_STBC_RX	0x00000004
+#define WLFEATURE_DISABLE_11N_SGI_TX	0x00000008
+#define WLFEATURE_DISABLE_11N_SGI_RX	0x00000010
+#define WLFEATURE_DISABLE_11N_AMPDU_TX	0x00000020
+#define WLFEATURE_DISABLE_11N_AMPDU_RX	0x00000040
+#define WLFEATURE_DISABLE_11N_GF	0x00000080
+
+/* Proxy STA modes */
+#define PSTA_MODE_DISABLED		0
+#define PSTA_MODE_PROXY			1
+#define PSTA_MODE_REPEATER		2
+
+
+/* NAT configuration */
 typedef struct {
-	struct  ether_addr ea;
-	uint8   ac_cat;
-	uint8   num_pkts;
-} wl_mac_ratehisto_cmd_t;
-
+	uint32 ipaddr;		/* interface ip address */
+	uint32 ipaddr_mask;	/* interface ip address mask */
+	uint32 ipaddr_gateway;	/* gateway ip address */
+	uint8 mac_gateway[6];	/* gateway mac address */
+	uint32 ipaddr_dns;	/* DNS server ip address, valid only for public if */
+	uint8 mac_dns[6];	/* DNS server mac address,  valid only for public if */
+	uint8 GUID[38];		/* interface GUID */
+} nat_if_info_t;
 
 typedef struct {
-	uint32  rate[WLC_MAXRATE + 1];
-	uint32  mcs_index[MCS_INDEX_SIZE];
-	uint32  tsf_timer[2][2];
-} wl_mac_ratehisto_res_t;
-
-#ifdef PROP_TXSTATUS
+	uint op;		/* operation code */
+	bool pub_if;		/* set for public if, clear for private if */
+	nat_if_info_t if_info;	/* interface info */
+} nat_cfg_t;
 
+/* op code in nat_cfg */
+#define NAT_OP_ENABLE		1	/* enable NAT on given interface */
+#define NAT_OP_DISABLE		2	/* disable NAT on given interface */
+#define NAT_OP_DISABLE_ALL	3	/* disable NAT on all interfaces */
 
-#define WLFC_FLAGS_RSSI_SIGNALS                         1
+/* NAT state */
+#define NAT_STATE_ENABLED	1	/* NAT is enabled */
+#define NAT_STATE_DISABLED	2	/* NAT is disabled */
 
+typedef struct {
+	int state;	/* NAT state returned */
+} nat_state_t;
 
-#define WLFC_FLAGS_XONXOFF_SIGNALS                      2
-
+#ifdef PROP_TXSTATUS
+/* Bit definitions for tlv iovar */
+/*
+ * enable RSSI signals:
+ * WLFC_CTL_TYPE_RSSI
+ */
+#define WLFC_FLAGS_RSSI_SIGNALS		0x0001
 
-#define WLFC_FLAGS_CREDIT_STATUS_SIGNALS        4
+/* enable (if/mac_open, if/mac_close,, mac_add, mac_del) signals:
+ *
+ * WLFC_CTL_TYPE_MAC_OPEN
+ * WLFC_CTL_TYPE_MAC_CLOSE
+ *
+ * WLFC_CTL_TYPE_INTERFACE_OPEN
+ * WLFC_CTL_TYPE_INTERFACE_CLOSE
+ *
+ * WLFC_CTL_TYPE_MACDESC_ADD
+ * WLFC_CTL_TYPE_MACDESC_DEL
+ *
+ */
+#define WLFC_FLAGS_XONXOFF_SIGNALS	0x0002
 
-#define WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE     8
-#define WLFC_FLAGS_PSQ_GENERATIONFSM_ENABLE     16
-#define WLFC_FLAGS_PSQ_ZERO_BUFFER_ENABLE	32
-#endif
+/* enable (status, fifo_credit, mac_credit) signals
+ * WLFC_CTL_TYPE_MAC_REQUEST_CREDIT
+ * WLFC_CTL_TYPE_TXSTATUS
+ * WLFC_CTL_TYPE_FIFO_CREDITBACK
+ */
+#define WLFC_FLAGS_CREDIT_STATUS_SIGNALS	0x0004
 
-#define BTA_STATE_LOG_SZ    64
+#define WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE	0x0008
+#define WLFC_FLAGS_PSQ_GENERATIONFSM_ENABLE	0x0010
+#define WLFC_FLAGS_PSQ_ZERO_BUFFER_ENABLE	0x0020
+#define WLFC_FLAGS_HOST_RXRERODER_ACTIVE	0x0040
+#endif /* PROP_TXSTATUS */
 
+#define BTA_STATE_LOG_SZ	64
 
+/* BTAMP Statemachine states */
 enum {
 	HCIReset = 1,
 	HCIReadLocalAMPInfo,
@@ -2964,10 +5257,10 @@ typedef struct flush_txfifo {
 	struct ether_addr ea;
 } flush_txfifo_t;
 
-#define CHANNEL_5G_LOW_START    36
-#define CHANNEL_5G_MID_START    52
-#define CHANNEL_5G_HIGH_START   100
-#define CHANNEL_5G_UPPER_START  149
+#define CHANNEL_5G_LOW_START	36	/* 5G low (36..48) CDD enable/disable bit mask */
+#define CHANNEL_5G_MID_START	52	/* 5G mid (52..64) CDD enable/disable bit mask */
+#define CHANNEL_5G_HIGH_START	100	/* 5G high (100..140) CDD enable/disable bit mask */
+#define CHANNEL_5G_UPPER_START	149	/* 5G upper (149..161) CDD enable/disable bit mask */
 
 enum {
 	SPATIAL_MODE_2G_IDX = 0,
@@ -2978,4 +5271,248 @@ enum {
 	SPATIAL_MODE_MAX_IDX
 };
 
-#endif
+#define WLC_TXCORE_MAX	4	/* max number of txcore supports */
+#define WLC_SUBBAND_MAX	4	/* max number of sub-band supports */
+typedef struct {
+	uint8	band2g[WLC_TXCORE_MAX];
+	uint8	band5g[WLC_SUBBAND_MAX][WLC_TXCORE_MAX];
+} sar_limit_t;
+
+/* IOVAR "mempool" parameter. Used to retrieve a list of memory pool statistics. */
+typedef struct wl_mempool_stats {
+	int	num;		/* Number of memory pools */
+	bcm_mp_stats_t s[1];	/* Variable array of memory pool stats. */
+} wl_mempool_stats_t;
+
+
+/* D0 Coalescing */
+#define IPV4_ARP_FILTER		0x0001
+#define IPV4_NETBT_FILTER	0x0002
+#define IPV4_LLMNR_FILTER	0x0004
+#define IPV4_SSDP_FILTER	0x0008
+#define IPV4_WSD_FILTER		0x0010
+#define IPV6_NETBT_FILTER	0x0200
+#define IPV6_LLMNR_FILTER	0x0400
+#define IPV6_SSDP_FILTER	0x0800
+#define IPV6_WSD_FILTER		0x1000
+
+/* Network Offload Engine */
+#define NWOE_OL_ENABLE		0x00000001
+
+typedef struct {
+	uint32 ipaddr;
+	uint32 ipaddr_netmask;
+	uint32 ipaddr_gateway;
+} nwoe_ifconfig_t;
+
+/*
+ * Traffic management structures/defines.
+ */
+
+/* Traffic management bandwidth parameters */
+#define TRF_MGMT_MAX_PRIORITIES                 3
+
+#define TRF_MGMT_FLAG_ADD_DSCP                  0x0001  /* Add DSCP to IP TOS field */
+#define TRF_MGMT_FLAG_DISABLE_SHAPING           0x0002  /* Don't shape traffic */
+#define TRF_MGMT_FLAG_MANAGE_LOCAL_TRAFFIC      0x0008  /* Manage traffic over our local subnet */
+#define TRF_MGMT_FLAG_FILTER_ON_MACADDR         0x0010  /* filter on MAC address */
+#define TRF_MGMT_FLAG_NO_RX                     0x0020  /* do not apply fiters to rx packets */
+
+#define TRF_FILTER_MAC_ADDR              0x0001 /* L2 filter use dst mac address for filtering */
+#define TRF_FILTER_IP_ADDR               0x0002 /* L3 filter use ip ddress for filtering */
+#define TRF_FILTER_L4                    0x0004 /* L4 filter use tcp/udp for filtering */
+#define TRF_FILTER_FAVORED               0x0010 /* Tag the packet FAVORED */
+
+/* Traffic management priority classes */
+typedef enum trf_mgmt_priority_class {
+	trf_mgmt_priority_low           = 0,        /* Maps to 802.1p BK */
+	trf_mgmt_priority_medium        = 1,        /* Maps to 802.1p BE */
+	trf_mgmt_priority_high          = 2,        /* Maps to 802.1p VI */
+	trf_mgmt_priority_nochange	= 3,	    /* do not update the priority */
+	trf_mgmt_priority_invalid       = (trf_mgmt_priority_nochange + 1)
+} trf_mgmt_priority_class_t;
+
+/* Traffic management configuration parameters */
+typedef struct trf_mgmt_config {
+	uint32  trf_mgmt_enabled;                           /* 0 - disabled, 1 - enabled */
+	uint32  flags;                                      /* See TRF_MGMT_FLAG_xxx defines */
+	uint32  host_ip_addr;                               /* My IP address to determine subnet */
+	uint32  host_subnet_mask;                           /* My subnet mask */
+	uint32  downlink_bandwidth;                         /* In units of kbps */
+	uint32  uplink_bandwidth;                           /* In units of kbps */
+	uint32  min_tx_bandwidth[TRF_MGMT_MAX_PRIORITIES];  /* Minimum guaranteed tx bandwidth */
+	uint32  min_rx_bandwidth[TRF_MGMT_MAX_PRIORITIES];  /* Minimum guaranteed rx bandwidth */
+} trf_mgmt_config_t;
+
+/* Traffic management filter */
+typedef struct trf_mgmt_filter {
+	struct ether_addr           dst_ether_addr;         /* His L2 address */
+	uint32                      dst_ip_addr;            /* His IP address */
+	uint16                      dst_port;               /* His L4 port */
+	uint16                      src_port;               /* My L4 port */
+	uint16                      prot;                   /* L4 protocol (only TCP or UDP) */
+	uint16                      flags;                  /* TBD. For now, this must be zero. */
+	trf_mgmt_priority_class_t   priority;               /* Priority for filtered packets */
+} trf_mgmt_filter_t;
+
+/* Traffic management filter list (variable length) */
+typedef struct trf_mgmt_filter_list     {
+	uint32              num_filters;
+	trf_mgmt_filter_t   filter[1];
+} trf_mgmt_filter_list_t;
+
+/* Traffic management global info used for all queues */
+typedef struct trf_mgmt_global_info {
+	uint32  maximum_bytes_per_second;
+	uint32  maximum_bytes_per_sampling_period;
+	uint32  total_bytes_consumed_per_second;
+	uint32  total_bytes_consumed_per_sampling_period;
+	uint32  total_unused_bytes_per_sampling_period;
+} trf_mgmt_global_info_t;
+
+/* Traffic management shaping info per priority queue */
+typedef struct trf_mgmt_shaping_info {
+	uint32  gauranteed_bandwidth_percentage;
+	uint32  guaranteed_bytes_per_second;
+	uint32  guaranteed_bytes_per_sampling_period;
+	uint32  num_bytes_produced_per_second;
+	uint32  num_bytes_consumed_per_second;
+	uint32  num_queued_packets;                         /* Number of packets in queue */
+	uint32  num_queued_bytes;                           /* Number of bytes in queue */
+} trf_mgmt_shaping_info_t;
+
+/* Traffic management shaping info array */
+typedef struct trf_mgmt_shaping_info_array {
+	trf_mgmt_global_info_t   tx_global_shaping_info;
+	trf_mgmt_shaping_info_t  tx_queue_shaping_info[TRF_MGMT_MAX_PRIORITIES];
+	trf_mgmt_global_info_t   rx_global_shaping_info;
+	trf_mgmt_shaping_info_t  rx_queue_shaping_info[TRF_MGMT_MAX_PRIORITIES];
+} trf_mgmt_shaping_info_array_t;
+
+
+/* Traffic management statistical counters */
+typedef struct trf_mgmt_stats {
+	uint32  num_processed_packets;      /* Number of packets processed */
+	uint32  num_processed_bytes;        /* Number of bytes processed */
+	uint32  num_discarded_packets;      /* Number of packets discarded from queue */
+} trf_mgmt_stats_t;
+
+/* Traffic management statisics array */
+typedef struct trf_mgmt_stats_array     {
+	trf_mgmt_stats_t  tx_queue_stats[TRF_MGMT_MAX_PRIORITIES];
+	trf_mgmt_stats_t  rx_queue_stats[TRF_MGMT_MAX_PRIORITIES];
+} trf_mgmt_stats_array_t;
+
+typedef struct powersel_params {
+	/* LPC Params exposed via IOVAR */
+	int32		tp_ratio_thresh;  /* Throughput ratio threshold */
+	uint8		rate_stab_thresh; /* Thresh for rate stability based on nupd */
+	uint8		pwr_stab_thresh; /* Number of successes before power step down */
+	uint8		pwr_sel_exp_time; /* Time lapse for expiry of database */
+} powersel_params_t;
+
+/* tx pkt delay statistics */
+#define	SCB_RETRY_SHORT_DEF	7	/* Default Short retry Limit */
+#define WLPKTDLY_HIST_NBINS	16	/* number of bins used in the Delay histogram */
+
+/* structure to store per-AC delay statistics */
+typedef struct scb_delay_stats {
+	uint32 txmpdu_lost;	/* number of MPDUs lost */
+	uint32 txmpdu_cnt[SCB_RETRY_SHORT_DEF]; /* retry times histogram */
+	uint32 delay_sum[SCB_RETRY_SHORT_DEF]; /* cumulative packet latency */
+	uint32 delay_min;	/* minimum packet latency observed */
+	uint32 delay_max;	/* maximum packet latency observed */
+	uint32 delay_avg;	/* packet latency average */
+	uint32 delay_hist[WLPKTDLY_HIST_NBINS];	/* delay histogram */
+} scb_delay_stats_t;
+
+/* structure for txdelay event */
+typedef struct txdelay_event {
+	uint8	status;
+	int		rssi;
+	chanim_stats_t		chanim_stats;
+	scb_delay_stats_t	delay_stats[AC_COUNT];
+} txdelay_event_t;
+
+/* structure for txdelay parameters */
+typedef struct txdelay_params {
+	uint16	ratio;	/* Avg Txdelay Delta */
+	uint8	cnt;	/* Sample cnt */
+	uint8	period;	/* Sample period */
+	uint8	tune;	/* Debug */
+} txdelay_params_t;
+
+#define WL_RELMCAST_MAX_CLIENT 			32
+#define WL_RELMCAST_FLAG_INBLACKLIST	1
+#define WL_RELMCAST_FLAG_ACTIVEACKER	2
+#define WL_RELMCAST_FLAG_RELMCAST		4
+
+#define WL_RELMCAST_VER					1
+
+typedef struct wl_relmcast_client {
+	uint8 flag;
+	int16 rssi;
+	struct ether_addr addr;
+} wl_relmcast_client_t;
+
+typedef struct wl_relmcast_st {
+	uint8 ver;
+	uint8 num;
+	wl_relmcast_client_t clients[WL_RELMCAST_MAX_CLIENT];
+} wl_relmcast_status_t;
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* fbt_cap: FBT assoc / reassoc modes. */
+#define WLC_FBT_CAP_DRV_4WAY_AND_REASSOC  1 /* Driver 4-way handshake & reassoc (WLFBT). */
+
+typedef struct bcnreq {
+	uint8 bcn_mode;
+	int dur;
+	int channel;
+	struct ether_addr da;
+	uint16 random_int;
+	wlc_ssid_t ssid;
+	uint16 reps;
+} bcnreq_t;
+
+typedef struct rrmreq {
+	struct ether_addr da;
+	uint8 reg;
+	uint8 chan;
+	uint16 random_int;
+	uint16 dur;
+	uint16 reps;
+} rrmreq_t;
+
+typedef struct framereq {
+	struct ether_addr da;
+	uint8 reg;
+	uint8 chan;
+	uint16 random_int;
+	uint16 dur;
+	struct ether_addr ta;
+	uint16 reps;
+} framereq_t;
+
+typedef struct statreq {
+	struct ether_addr da;
+	struct ether_addr peer;
+	uint16 random_int;
+	uint16 dur;
+	uint8 group_id;
+	uint16 reps;
+} statreq_t;
+
+typedef struct wl_el_set_params_s {
+	uint8 set;	/* Set number */
+	uint32 size;	/* Size to make/expand */
+} wl_el_set_params_t;
+
+typedef struct wl_el_tag_params_s {
+	uint16 tag;
+	uint8 set;
+	uint8 flags;
+} wl_el_tag_params_t;
+
+#endif /* _wlioctl_h_ */
diff --git a/bcmdhd/dhdutil/miniopt.c b/bcmdhd/dhdutil/miniopt.c
index ec720e0..e30e75f 100644
--- a/bcmdhd/dhdutil/miniopt.c
+++ b/bcmdhd/dhdutil/miniopt.c
@@ -1,7 +1,7 @@
 /*
  * Description.
  *
- * Copyright (C) 1999-2012, Broadcom Corporation
+ * Copyright (C) 1999-2013, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/bcmdhd/dhdutil/ucode_download.c b/bcmdhd/dhdutil/ucode_download.c
new file mode 100644
index 0000000..0dd08af
--- /dev/null
+++ b/bcmdhd/dhdutil/ucode_download.c
@@ -0,0 +1,263 @@
+/*
+ * Ucode download related utility functions
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: ucode_download.c 297277 2011-11-18 14:10:09Z $
+ */
+
+#include <unistd.h>
+#include <errno.h>
+#include <trxhdr.h>
+#include <bcmendian.h>
+#include <wlu_common.h>
+
+#define DEVPRESENT_DELAY  10000	/* in microsecs */
+#define DEVPRESENT_RETRIES   100
+
+extern int wl_validatedev(void *dev_handle);
+
+int
+dload_generic_data(void *wl, uint16 dload_type, unsigned char *dload_buf, int len)
+{
+	struct wl_dload_data *dload_ptr = (struct wl_dload_data *)dload_buf;
+	int err = 0;
+	int actual_data_offset;
+	char *buf;
+
+	actual_data_offset = OFFSETOF(struct wl_dload_data, data);
+	dload_ptr->flag = (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT);
+	dload_ptr->flag |= DL_CRC_NOT_INUSE;
+	dload_ptr->dload_type = dload_type;
+	dload_ptr->len = htod32(len - actual_data_offset);
+	dload_ptr->crc = 0;
+
+	len = len + 8 - (len%8);
+
+	buf = malloc(WLC_IOCTL_MEDLEN);
+	if (buf) {
+		bzero(buf, WLC_IOCTL_MEDLEN);
+		err = wlu_iovar_setbuf(wl, "generic_dload", dload_buf, len, buf,
+			WLC_IOCTL_MEDLEN);
+	}
+	free(buf);
+	return err;
+}
+
+int
+dload_ucode_part(void *wl, uint8 ucode_type, uint32 datalen, unsigned char *org_buf)
+{
+	int num_chunks, chunk_len, cumulative_len = 0;
+	int size2alloc, ucode_chunk_len = 0;
+	unsigned char *new_buf;
+	struct wl_ucode_info *ucode_ptr;
+	int err = 0, ucode_offset, chunk_offset;
+
+	ucode_offset = OFFSETOF(wl_dload_data_t, data);
+	chunk_offset = OFFSETOF(wl_ucode_info_t, data_chunk);
+
+	err = wlu_iovar_getint(wl, "ucdload_chunk_len",
+		&ucode_chunk_len);
+	if (err) {
+		printf("err in getting ucode chunk len, exiting\n");
+		return err;
+	}
+
+	num_chunks = datalen/ucode_chunk_len;
+	if (datalen % ucode_chunk_len != 0)
+		num_chunks++;
+	size2alloc = ucode_offset + chunk_offset + ucode_chunk_len;
+
+	/* single chunk buffer */
+	new_buf = (unsigned char *)malloc(size2alloc);
+	memset(new_buf, 0, size2alloc);
+	ucode_ptr = (struct wl_ucode_info *)((uint8 *)new_buf+ucode_offset);
+	ucode_ptr->ucode_type = ucode_type;
+	ucode_ptr->num_chunks = num_chunks;
+	do {
+		if (datalen >= ucode_chunk_len)
+			chunk_len = ucode_chunk_len;
+		else
+			chunk_len = datalen;
+		memset(new_buf+ucode_offset+chunk_offset, 0, size2alloc-ucode_offset-chunk_offset);
+		ucode_ptr->chunk_len = htod32(chunk_len);
+		ucode_ptr->chunk_num++;
+		memcpy(&ucode_ptr->data_chunk[0], org_buf + cumulative_len, chunk_len);
+		cumulative_len += chunk_len;
+		err = dload_generic_data(wl, DL_TYPE_UCODE, new_buf, size2alloc);
+		if (err) {
+			printf("error while writing %s to the memory\n",
+				(ucode_type == UCODE_FW)? "ucode" : "initvals");
+			break;
+		}
+		datalen = datalen - chunk_len;
+	} while (datalen > 0);
+	free(new_buf);
+
+	return err;
+}
+
+static int
+check_ucode_file(unsigned char *headers)
+{
+	struct trx_header *trx;
+	int actual_data_len = -1;
+
+	/* Extract trx header */
+	trx = (struct trx_header *)headers;
+	if (trx->magic != TRX_MAGIC) {
+		printf("Error: trx bad hdr\n");
+		goto err;
+	}
+	actual_data_len = ROUNDUP(trx->offsets[0], 4) + ROUNDUP(trx->offsets[1], 4);
+err:
+	return actual_data_len;
+}
+
+int
+proc_ucode_download(char* fw_filename, void *dev_handle)
+{
+	FILE *fp = NULL;
+	int ret = 0, loopcnt = 0;
+	struct trx_header main_trx_hdr, *ucode_trx_hdr;
+	uint32 maintrx_hdr_len, tmp_len;
+	uint32 fw_size, second_offset, ucode_trx_offset;
+	long ucode_pos;
+	unsigned long ucode_info_len = 0, status;
+	unsigned char *ucodetrx_buf, *initvals_ptr;
+	int ucode_len, initvals_len;
+	int ucdload_status = 0;
+	int is_devpresent;
+
+	/* read the file and push blocks down to memory */
+	if ((fp = fopen(fw_filename, "rb")) == NULL) {
+		fprintf(stderr, "%s: unable to open %s: %s\n",
+		        __FUNCTION__, fw_filename, strerror(errno));
+		ret = -1;
+		goto exit;
+	}
+
+	maintrx_hdr_len = sizeof(struct trx_header);
+	tmp_len = fread(&main_trx_hdr, sizeof(uint8), maintrx_hdr_len, fp);
+
+	if (tmp_len == maintrx_hdr_len) {
+		if (main_trx_hdr.magic == TRX_MAGIC) {
+			fw_size = main_trx_hdr.offsets[0];
+			second_offset = main_trx_hdr.offsets[2];
+
+			if (second_offset == maintrx_hdr_len) {
+				second_offset = 0;
+			}
+			ucode_trx_offset = maintrx_hdr_len +
+				ROUNDUP(fw_size, 4) + ROUNDUP(second_offset, 4);
+			ucode_pos = fseek(fp, ucode_trx_offset, SEEK_SET);
+			BCM_REFERENCE(ucode_pos);
+
+			if ((ucode_trx_hdr = malloc(sizeof(struct trx_header)))
+				== NULL) {
+				printf("Unable to allocate %d bytes!\n", maintrx_hdr_len);
+				ret = -ENOMEM;
+				goto exit;
+			}
+
+			/* Read ONLY the firmware-file-header into the new_buffer */
+			status = fread(ucode_trx_hdr, sizeof(uint8),
+				maintrx_hdr_len, fp);
+			if (status < sizeof(struct trx_header)) {
+				printf("Short read in hdr read for %s!\n", fw_filename);
+				ret = -EINVAL;
+				goto exit;
+			}
+
+			if ((ucode_info_len = check_ucode_file(
+				(unsigned char *)ucode_trx_hdr)) <= 0) {
+				printf("not a valid ucode.trx\n");
+				ret = -1;
+				goto exit;
+			}
+
+			ucodetrx_buf = (unsigned char *)malloc(ucode_info_len *
+				sizeof(char));
+			tmp_len = fread(ucodetrx_buf, sizeof(uint8),
+				ucode_info_len, fp);
+			if (ucode_info_len > 0) {
+				ucode_len = ucode_trx_hdr->offsets[0];
+				initvals_ptr = ucodetrx_buf +
+					ROUNDUP(ucode_trx_hdr->offsets[0], 4);
+				initvals_len = ucode_trx_hdr->offsets[1];
+			}
+			free(ucode_trx_hdr);
+
+			init_cmd_batchingmode();
+			do {
+				is_devpresent = wl_validatedev(dev_handle);
+				loopcnt++;
+				/* in USB after dongle fw starts running wl interface
+				might not appear in the list of interfaces immediately, hence try
+				after some delay of 10ms
+				*/
+				if (!is_devpresent)
+					usleep(DEVPRESENT_DELAY);
+				else {
+						/* below iovar to verify if the for foundout
+						interface has already ucode been downloaded
+						*/
+						ret = wlu_iovar_getint(dev_handle, "ucdload_status",
+							&ucdload_status);
+						if (ret) {
+							printf("err in ucdload_status, exiting\n");
+							goto exit;
+						}
+						if (ucdload_status) {
+							/* Number of 'wl' interfaces to skip
+							in the next round of going thru wl_find
+							*/
+							printf("ucode is already downloaded\n");
+						}
+				}
+			/* usb seems to take some time to come up, hence the
+			loop value of 100
+			*/
+			} while (loopcnt < DEVPRESENT_RETRIES && !is_devpresent);
+
+			if (loopcnt < DEVPRESENT_RETRIES) {
+				/* download the ucode fw */
+				ret = dload_ucode_part(dev_handle, UCODE_FW, ucode_len,
+					ucodetrx_buf);
+				if (ret) {
+					printf("error while downloading ucode, exiting\n");
+					goto exit;
+				}
+				/* download the initvals to the dongle */
+				ret = dload_ucode_part(dev_handle, INIT_VALS,
+					initvals_len, initvals_ptr);
+
+				if (ret) {
+					printf("error while downloading initvals, exiting\n");
+					goto exit;
+				}
+			}
+			else {
+				printf("wl device is not present\n");
+			}
+			free(ucodetrx_buf);
+		}
+	}
+
+exit:
+	if (fp)
+		fclose(fp);
+	return ret;
+}
diff --git a/bcmdhd/dhdutil/ucode_download.h b/bcmdhd/dhdutil/ucode_download.h
new file mode 100644
index 0000000..a338684
--- /dev/null
+++ b/bcmdhd/dhdutil/ucode_download.h
@@ -0,0 +1,21 @@
+/*
+ * Ucode download related utility functions
+ *
+ * Copyright (C) 1999-2013, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: ucode_download.h 241182 2011-02-17 21:50:03Z $
+ */
+extern int
+proc_ucode_download(char* fw_filename, void *dev_handle);