add support for the new broadcom driver to wificonf. wep is currently broken. will fix that later, when i find out what's wrong with it

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@2480 3c298f89-4303-0410-b956-a3cf2f4a3e73

10 files changed, 3273 insertions, 112 deletions

diff --git a/openwrt/package/wificonf/Makefile b/openwrt/package/wificonf/Makefile
index f027cd00f1..5f8c9a03a6 100644
--- a/openwrt/package/wificonf/Makefile
+++ b/openwrt/package/wificonf/Makefile
@@ -19,7 +19,7 @@ $(PKG_BUILD_DIR)/.configured:
 	touch $@
 
 $(PKG_BUILD_DIR)/.built:
-	$(TARGET_CC) $(TARGET_CFLAGS) -I$(STAGING_DIR)/usr/include -o $(PKG_BUILD_DIR)/wifi wificonf.c -L$(STAGING_DIR)/usr/lib -lnvram -lshared $(STAGING_DIR)/usr/lib/libiw.so
+	$(TARGET_CC) $(TARGET_CFLAGS) -Iinclude/ -I$(STAGING_DIR)/usr/include -o $(PKG_BUILD_DIR)/wifi wificonf.c -L$(STAGING_DIR)/usr/lib -lnvram -lshared $(STAGING_DIR)/usr/lib/libiw.so
 	touch $@
 
 $(IPKG_WIFICONF):
diff --git a/openwrt/package/wificonf/include/proto/802.11.h b/openwrt/package/wificonf/include/proto/802.11.h
new file mode 100644
index 0000000000..ac2b898e2e
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/802.11.h
@@ -0,0 +1,930 @@
+/*
+ * Copyright 2005, Broadcom Corporation      
+ * All Rights Reserved.      
+ *       
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY      
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM      
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS      
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.      
+ *
+ * Fundamental types and constants relating to 802.11 
+ *
+ * $Id$
+ */
+
+#ifndef _802_11_H_
+#define _802_11_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#ifndef _NET_ETHERNET_H_
+#include <proto/ethernet.h>
+#endif
+
+#include <proto/wpa.h>
+
+
+/* enable structure packing */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#pragma pack(1)
+#define	PACKED
+#endif
+
+#define DOT11_TU_TO_US			1024	/* 802.11 Time Unit is 1024 microseconds */
+
+/* Generic 802.11 frame constants */
+#define DOT11_A3_HDR_LEN		24
+#define DOT11_A4_HDR_LEN		30
+#define DOT11_MAC_HDR_LEN		DOT11_A3_HDR_LEN
+#define DOT11_FCS_LEN			4
+#define DOT11_ICV_LEN			4
+#define DOT11_ICV_AES_LEN		8
+#define DOT11_QOS_LEN			2
+
+#define DOT11_KEY_INDEX_SHIFT		6
+#define DOT11_IV_LEN			4
+#define DOT11_IV_TKIP_LEN		8
+#define DOT11_IV_AES_OCB_LEN		4
+#define DOT11_IV_AES_CCM_LEN		8
+
+/* Includes MIC */
+#define DOT11_MAX_MPDU_BODY_LEN		2304
+/* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
+#define DOT11_MAX_MPDU_LEN		(DOT11_A4_HDR_LEN + \
+					 DOT11_QOS_LEN + \
+					 DOT11_IV_AES_CCM_LEN + \
+					 DOT11_MAX_MPDU_BODY_LEN + \
+					 DOT11_ICV_LEN + \
+					 DOT11_FCS_LEN)
+
+#define DOT11_MAX_SSID_LEN		32
+
+/* dot11RTSThreshold */
+#define DOT11_DEFAULT_RTS_LEN		2347
+#define DOT11_MAX_RTS_LEN		2347
+
+/* dot11FragmentationThreshold */
+#define DOT11_MIN_FRAG_LEN		256
+#define DOT11_MAX_FRAG_LEN		2346	/* Max frag is also limited by aMPDUMaxLength of the attached PHY */
+#define DOT11_DEFAULT_FRAG_LEN		2346
+
+/* dot11BeaconPeriod */
+#define DOT11_MIN_BEACON_PERIOD		1
+#define DOT11_MAX_BEACON_PERIOD		0xFFFF
+
+/* dot11DTIMPeriod */
+#define DOT11_MIN_DTIM_PERIOD		1
+#define DOT11_MAX_DTIM_PERIOD		0xFF
+
+/* 802.2 LLC/SNAP header used by 802.11 per 802.1H */
+#define DOT11_LLC_SNAP_HDR_LEN	8
+#define DOT11_OUI_LEN			3
+struct dot11_llc_snap_header {
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[DOT11_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
+						   Bridge-Tunnel: 0x00 0x00 0xF8 */
+	uint16	type;				/* ethertype */
+} PACKED;
+
+/* RFC1042 header used by 802.11 per 802.1H */
+#define RFC1042_HDR_LEN			(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)
+
+/* Generic 802.11 MAC header */
+/*
+ * N.B.: This struct reflects the full 4 address 802.11 MAC header.
+ *		 The fields are defined such that the shorter 1, 2, and 3
+ *		 address headers just use the first k fields.
+ */
+struct dot11_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	a1;		/* address 1 */
+	struct ether_addr	a2;		/* address 2 */
+	struct ether_addr	a3;		/* address 3 */
+	uint16			seq;		/* sequence control */
+	struct ether_addr	a4;		/* address 4 */
+} PACKED;
+
+/* Control frames */
+
+struct dot11_rts_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	ta;		/* transmitter address */
+} PACKED;
+#define	DOT11_RTS_LEN		16
+
+struct dot11_cts_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+} PACKED;
+#define	DOT11_CTS_LEN		10
+
+struct dot11_ack_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+} PACKED;
+#define	DOT11_ACK_LEN		10
+
+struct dot11_ps_poll_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* AID */
+	struct ether_addr	bssid;		/* receiver address, STA in AP */
+	struct ether_addr	ta;		/* transmitter address */
+} PACKED;
+#define	DOT11_PS_POLL_LEN	16
+
+struct dot11_cf_end_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	bssid;		/* transmitter address, STA in AP */
+} PACKED;
+#define	DOT11_CS_END_LEN	16
+
+/* Management frame header */
+struct dot11_management_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	da;		/* receiver address */
+	struct ether_addr	sa;		/* transmitter address */
+	struct ether_addr	bssid;		/* BSS ID */
+	uint16			seq;		/* sequence control */
+} PACKED;
+#define	DOT11_MGMT_HDR_LEN	24
+
+/* Management frame payloads */
+
+struct dot11_bcn_prb {
+	uint32			timestamp[2];
+	uint16			beacon_interval;
+	uint16			capability;
+} PACKED;
+#define	DOT11_BCN_PRB_LEN	12
+
+struct dot11_auth {
+	uint16			alg;		/* algorithm */
+	uint16			seq;		/* sequence control */
+	uint16			status;		/* status code */
+} PACKED;
+#define DOT11_AUTH_FIXED_LEN	6		/* length of auth frame without challenge info elt */
+
+struct dot11_assoc_req {
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
+} PACKED;
+#define DOT11_ASSOC_REQ_FIXED_LEN	4	/* length of assoc frame without info elts */
+
+struct dot11_reassoc_req {
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
+	struct ether_addr	ap;		/* Current AP address */
+} PACKED;
+#define DOT11_REASSOC_REQ_FIXED_LEN	10	/* length of assoc frame without info elts */
+
+struct dot11_assoc_resp {
+	uint16			capability;	/* capability information */
+	uint16			status;		/* status code */
+	uint16			aid;		/* association ID */
+} PACKED;
+
+struct dot11_action_measure {
+	uint8	category;
+	uint8	action;
+	uint8	token;
+	uint8	data[1];
+} PACKED;
+#define DOT11_ACTION_MEASURE_LEN	3
+
+struct dot11_action_switch_channel {
+	uint8	category;
+	uint8	action;
+	uint8	data[5]; /* for switch IE */
+} PACKED;
+
+/**************
+  802.11h related definitions.
+**************/
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 power;
+} dot11_power_cnst_t;
+
+typedef struct {
+	uint8 min;
+	uint8 max;
+} dot11_power_cap_t;
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 tx_pwr;
+	uint8 margin;
+} dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_LEN	2	/* length of IE data, not including 2 byte header */
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 first_channel;
+	uint8 num_channels;
+} dot11_supp_channels_t;
+
+/* csa mode type */
+#define DOT11_CSA_MODE_ADVISORY		0
+#define DOT11_CSA_MODE_NO_TX		1
+struct dot11_channel_switch {
+	uint8 id;
+	uint8 len;
+	uint8 mode;
+	uint8 channel;
+	uint8 count;
+}  PACKED;
+typedef struct dot11_channel_switch dot11_channel_switch_t;
+
+/* length of IE data, not including 2 byte header */
+#define DOT11_SWITCH_IE_LEN             3 
+
+/* 802.11h Measurement Request/Report IEs */
+/* Measurement Type field */
+#define DOT11_MEASURE_TYPE_BASIC 	0
+#define DOT11_MEASURE_TYPE_CCA 		1
+#define DOT11_MEASURE_TYPE_RPI	 	2
+
+/* Measurement Mode field */
+
+/* Measurement Request Modes */
+#define DOT11_MEASURE_MODE_ENABLE 	(1<<1)
+#define DOT11_MEASURE_MODE_REQUEST	(1<<2)
+#define DOT11_MEASURE_MODE_REPORT 	(1<<3)
+/* Measurement Report Modes */
+#define DOT11_MEASURE_MODE_LATE 	(1<<0)
+#define DOT11_MEASURE_MODE_INCAPABLE	(1<<1)
+#define DOT11_MEASURE_MODE_REFUSED	(1<<2)
+/* Basic Measurement Map bits */
+#define DOT11_MEASURE_BASIC_MAP_BSS	((uint8)(1<<0))
+#define DOT11_MEASURE_BASIC_MAP_OFDM	((uint8)(1<<1))
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN	((uint8)(1<<2))
+#define DOT11_MEASURE_BASIC_MAP_RADAR	((uint8)(1<<3))
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS	((uint8)(1<<4))
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 channel;
+	uint8 start_time[8];
+	uint16 duration;
+} dot11_meas_req_t;
+#define DOT11_MNG_IE_MREQ_LEN 14
+/* length of Measure Request IE data not including variable len */
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3
+
+struct dot11_meas_rep {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	union 
+	{
+		struct {
+			uint8 channel;
+			uint8 start_time[8];
+			uint16 duration;
+			uint8 map;
+		} PACKED basic;
+		uint8 data[1];
+	} PACKED rep;
+} PACKED;
+typedef struct dot11_meas_rep dot11_meas_rep_t;
+
+/* length of Measure Report IE data not including variable len */
+#define DOT11_MNG_IE_MREP_FIXED_LEN	3
+
+struct dot11_meas_rep_basic {
+	uint8 channel;
+	uint8 start_time[8];
+	uint16 duration;
+	uint8 map;
+} PACKED;
+typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
+#define DOT11_MEASURE_BASIC_REP_LEN	12
+
+struct dot11_quiet {
+	uint8 id;
+	uint8 len;
+	uint8 count;	/* TBTTs until beacon interval in quiet starts */
+	uint8 period;	/* Beacon intervals between periodic quiet periods ? */
+	uint16 duration;/* Length of quiet period, in TU's */
+	uint16 offset;	/* TU's offset from TBTT in Count field */
+} PACKED;
+typedef struct dot11_quiet dot11_quiet_t;
+
+typedef struct {
+	uint8 channel;
+	uint8 map;
+} chan_map_tuple_t;
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 eaddr[ETHER_ADDR_LEN];
+	uint8 interval;
+	chan_map_tuple_t map[1];
+} dot11_ibss_dfs_t;
+
+/* WME Elements */
+#define WME_OUI			"\x00\x50\xf2"
+#define WME_VER			1
+#define WME_TYPE		2
+#define WME_SUBTYPE_IE		0	/* Information Element */
+#define WME_SUBTYPE_PARAM_IE	1	/* Parameter Element */
+#define WME_SUBTYPE_TSPEC	2	/* Traffic Specification */
+
+/* WME Access Category Indices (ACIs) */
+#define AC_BE			0	/* Best Effort */
+#define AC_BK			1	/* Background */
+#define AC_VI			2	/* Video */
+#define AC_VO			3	/* Voice */
+#define AC_MAX			4
+
+/* WME Information Element (IE) */
+struct wme_ie {
+	uint8 oui[3];
+	uint8 type;
+	uint8 subtype;
+	uint8 version;
+	uint8 acinfo;
+} PACKED;
+typedef struct wme_ie wme_ie_t;
+#define WME_IE_LEN 7
+
+struct wme_acparam {
+	uint8	ACI;
+	uint8	ECW;
+	uint16  TXOP;		/* stored in network order (ls octet first) */
+} PACKED;
+typedef struct wme_acparam wme_acparam_t;
+
+/* WME Parameter Element (PE) */
+struct wme_params {
+	uint8 oui[3];
+	uint8 type;
+	uint8 subtype;
+	uint8 version;
+	uint8 acinfo;
+	uint8 rsvd;
+	wme_acparam_t acparam[4];
+} PACKED;
+typedef struct wme_params wme_params_t;
+#define WME_PARAMS_IE_LEN	24
+
+/* acinfo */
+#define WME_COUNT_MASK 	0x0f
+/* ACI */
+#define WME_AIFS_MASK 	0x0f
+#define WME_ACM_MASK 	0x10
+#define WME_ACI_MASK 	0x60
+#define WME_ACI_SHIFT 	5
+/* ECW */
+#define WME_CWMIN_MASK	0x0f
+#define WME_CWMAX_MASK	0xf0
+#define WME_CWMAX_SHIFT	4
+
+#define WME_TXOP_UNITS	32
+
+/* AP: default params to be announced in the Beacon Frames/Probe Responses Table 12 WME Draft*/
+/* AP:  default params to be Used in the AP Side Table 14 WME Draft January 2004 802.11-03-504r5 */
+#define WME_AC_BK_ACI_STA       0x27
+#define WME_AC_BK_ECW_STA       0xA4
+#define WME_AC_BK_TXOP_STA      0x0000
+#define WME_AC_BE_ACI_STA       0x03
+#define WME_AC_BE_ECW_STA       0xA4
+#define WME_AC_BE_TXOP_STA      0x0000
+#define WME_AC_VI_ACI_STA       0x42
+#define WME_AC_VI_ECW_STA       0x43
+#define WME_AC_VI_TXOP_STA      0x005e
+#define WME_AC_VO_ACI_STA       0x62
+#define WME_AC_VO_ECW_STA       0x32
+#define WME_AC_VO_TXOP_STA      0x002f
+                                                                                                             
+#define WME_AC_BK_ACI_AP        0x27
+#define WME_AC_BK_ECW_AP        0xA4
+#define WME_AC_BK_TXOP_AP       0x0000
+#define WME_AC_BE_ACI_AP        0x03
+#define WME_AC_BE_ECW_AP        0x64
+#define WME_AC_BE_TXOP_AP       0x0000
+#define WME_AC_VI_ACI_AP        0x41
+#define WME_AC_VI_ECW_AP        0x43
+#define WME_AC_VI_TXOP_AP       0x005e
+#define WME_AC_VO_ACI_AP        0x61
+#define WME_AC_VO_ECW_AP        0x32
+#define WME_AC_VO_TXOP_AP       0x002f
+
+/* WME Traffic Specification (TSPEC) element */
+#define WME_SUBTYPE_TSPEC 2
+#define WME_TSPEC_HDR_LEN		2
+#define WME_TSPEC_BODY_OFF		2
+struct wme_tspec {
+	uint8 oui[DOT11_OUI_LEN];	/* WME_OUI */
+	uint8 type;			/* WME_TYPE */
+	uint8 subtype;			/* WME_SUBTYPE_TSPEC */
+	uint8 version;			/* WME_VERSION */
+	uint16 ts_info;			/* TS Info */
+	uint16 nom_msdu_size;		/* (Nominal or fixed) MSDU Size (bytes) */
+	uint16 max_msdu_size;		/* Maximum MSDU Size (bytes) */
+	uint32 min_service_interval;	/* Minimum Service Interval (us) */
+	uint32 max_service_interval;	/* Maximum Service Interval (us) */
+	uint32 inactivity_interval;	/* Inactivity Interval (us) */
+	uint32 service_start;		/* Service Start Time (us) */
+	uint32 min_rate;		/* Minimum Data Rate (bps) */
+	uint32 mean_rate;		/* Mean Data Rate (bps) */
+	uint32 max_burst_size;		/* Maximum Burst Size (bytes) */
+	uint32 min_phy_rate;		/* Minimum PHY Rate (bps) */
+	uint32 peak_rate;		/* Peak Data Rate (bps) */
+	uint32 delay_bound;		/* Delay Bound (us) */
+	uint16 surplus_bandwidth;	/* Surplus Bandwidth Allowance Factor */
+	uint16 medium_time;		/* Medium Time (32 us/s periods) */
+} PACKED;
+typedef struct wme_tspec wme_tspec_t;
+#define WME_TSPEC_LEN 56		/* not including 2-byte header */
+
+/* ts_info */
+/* 802.1D priority is duplicated - bits 13-11 AND bits 3-1 */
+#define TS_INFO_PRIO_SHIFT_HI		11
+#define TS_INFO_PRIO_MASK_HI		(0x7 << TS_INFO_PRIO_SHIFT_HI)
+#define TS_INFO_PRIO_SHIFT_LO		1
+#define TS_INFO_PRIO_MASK_LO		(0x7 << TS_INFO_PRIO_SHIFT_LO)
+#define TS_INFO_CONTENTION_SHIFT	7
+#define TS_INFO_CONTENTION_MASK		(0x1 << TS_INFO_CONTENTION_SHIFT)
+#define TS_INFO_DIRECTION_SHIFT		5
+#define TS_INFO_DIRECTION_MASK		(0x3 << TS_INFO_DIRECTION_SHIFT)
+#define TS_INFO_UPLINK			(0 << TS_INFO_DIRECTION_SHIFT)
+#define TS_INFO_DOWNLINK		(1 << TS_INFO_DIRECTION_SHIFT)
+#define TS_INFO_BIDIRECTIONAL		(3 << TS_INFO_DIRECTION_SHIFT)
+
+/* nom_msdu_size */
+#define FIXED_MSDU_SIZE 0x8000		/* MSDU size is fixed */
+#define MSDU_SIZE_MASK	0x7fff		/* (Nominal or fixed) MSDU size */
+
+/* surplus_bandwidth */
+/* Represented as 3 bits of integer, binary point, 13 bits fraction */
+#define	INTEGER_SHIFT	13
+#define FRACTION_MASK	0x1FFF
+
+/* Management Notification Frame */
+struct dot11_management_notification {
+	uint8 category;			/* DOT11_ACTION_NOTIFICATION */
+	uint8 action;
+	uint8 token;
+	uint8 status;
+	uint8 data[1];			/* Elements */
+} PACKED;
+#define DOT11_MGMT_NOTIFICATION_LEN 4	/* Fixed length */
+
+/* WME Action Codes */
+#define WME_SETUP_REQUEST	0
+#define WME_SETUP_RESPONSE	1
+#define WME_TEARDOWN		2
+
+/* WME Setup Response Status Codes */
+#define WME_ADMISSION_ACCEPTED	0
+#define WME_INVALID_PARAMETERS	1
+#define WME_ADMISSION_REFUSED	3
+
+/* Macro to take a pointer to a beacon or probe response
+ * header and return the char* pointer to the SSID info element
+ */
+#define BCN_PRB_SSID(hdr) ((char*)(hdr) + DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_LEN)
+
+/* Authentication frame payload constants */
+#define DOT11_OPEN_SYSTEM	0
+#define DOT11_SHARED_KEY	1
+#define DOT11_CHALLENGE_LEN	128
+
+/* Frame control macros */
+#define FC_PVER_MASK		0x3
+#define FC_PVER_SHIFT		0
+#define FC_TYPE_MASK		0xC
+#define FC_TYPE_SHIFT		2
+#define FC_SUBTYPE_MASK		0xF0
+#define FC_SUBTYPE_SHIFT	4
+#define FC_TODS			0x100
+#define FC_TODS_SHIFT		8
+#define FC_FROMDS		0x200
+#define FC_FROMDS_SHIFT		9
+#define FC_MOREFRAG		0x400
+#define FC_MOREFRAG_SHIFT	10
+#define FC_RETRY		0x800
+#define FC_RETRY_SHIFT		11
+#define FC_PM			0x1000
+#define FC_PM_SHIFT		12
+#define FC_MOREDATA		0x2000
+#define FC_MOREDATA_SHIFT	13
+#define FC_WEP			0x4000
+#define FC_WEP_SHIFT		14
+#define FC_ORDER		0x8000
+#define FC_ORDER_SHIFT		15
+
+/* sequence control macros */
+#define SEQNUM_SHIFT		4
+#define FRAGNUM_MASK		0xF
+
+/* Frame Control type/subtype defs */
+
+/* FC Types */
+#define FC_TYPE_MNG		0
+#define FC_TYPE_CTL		1
+#define FC_TYPE_DATA		2
+
+/* Management Subtypes */
+#define FC_SUBTYPE_ASSOC_REQ		0
+#define FC_SUBTYPE_ASSOC_RESP		1
+#define FC_SUBTYPE_REASSOC_REQ		2
+#define FC_SUBTYPE_REASSOC_RESP		3
+#define FC_SUBTYPE_PROBE_REQ		4
+#define FC_SUBTYPE_PROBE_RESP		5
+#define FC_SUBTYPE_BEACON		8
+#define FC_SUBTYPE_ATIM			9
+#define FC_SUBTYPE_DISASSOC		10
+#define FC_SUBTYPE_AUTH			11
+#define FC_SUBTYPE_DEAUTH		12
+#define FC_SUBTYPE_ACTION		13
+
+/* Control Subtypes */
+#define FC_SUBTYPE_PS_POLL		10
+#define FC_SUBTYPE_RTS			11
+#define FC_SUBTYPE_CTS			12
+#define FC_SUBTYPE_ACK			13
+#define FC_SUBTYPE_CF_END		14
+#define FC_SUBTYPE_CF_END_ACK		15
+
+/* Data Subtypes */
+#define FC_SUBTYPE_DATA			0
+#define FC_SUBTYPE_DATA_CF_ACK		1
+#define FC_SUBTYPE_DATA_CF_POLL		2
+#define FC_SUBTYPE_DATA_CF_ACK_POLL	3
+#define FC_SUBTYPE_NULL			4
+#define FC_SUBTYPE_CF_ACK		5
+#define FC_SUBTYPE_CF_POLL		6
+#define FC_SUBTYPE_CF_ACK_POLL		7
+#define FC_SUBTYPE_QOS_DATA		8
+#define FC_SUBTYPE_QOS_NULL		12
+
+/* type-subtype combos */
+#define FC_KIND_MASK		(FC_TYPE_MASK | FC_SUBTYPE_MASK)
+
+#define FC_KIND(t, s) (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))
+
+#define FC_ASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)
+#define FC_ASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)
+#define FC_REASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)
+#define FC_REASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)
+#define FC_PROBE_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)
+#define FC_PROBE_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)
+#define FC_BEACON	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)
+#define FC_DISASSOC	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)
+#define FC_AUTH		FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)
+#define FC_DEAUTH	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)
+#define FC_ACTION	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)
+
+#define FC_PS_POLL	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)
+#define FC_RTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)
+#define FC_CTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)
+#define FC_ACK		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)
+#define FC_CF_END	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)
+#define FC_CF_END_ACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)
+
+#define FC_DATA		FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)
+#define FC_NULL_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)
+#define FC_DATA_CF_ACK	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)
+#define FC_QOS_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)
+#define FC_QOS_NULL	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)
+
+/* QoS Control Field */
+
+/* 802.1D Tag */
+#define QOS_PRIO_SHIFT		0
+#define QOS_PRIO_MASK		0x0007
+#define QOS_PRIO(qos)		(((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)
+
+#define QOS_TID_SHIFT		0
+#define QOS_TID_MASK		0x000f
+#define QOS_TID(qos)		(((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)
+
+/* Ack Policy (0 means Acknowledge) */
+#define QOS_ACK_SHIFT		5
+#define QOS_ACK_MASK		0x0060
+#define QOS_ACK(qos)		(((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)
+
+/* Management Frames */
+
+/* Management Frame Constants */
+
+/* Fixed fields */
+#define DOT11_MNG_AUTH_ALGO_LEN		2
+#define DOT11_MNG_AUTH_SEQ_LEN		2
+#define DOT11_MNG_BEACON_INT_LEN	2
+#define DOT11_MNG_CAP_LEN		2
+#define DOT11_MNG_AP_ADDR_LEN		6
+#define DOT11_MNG_LISTEN_INT_LEN	2
+#define DOT11_MNG_REASON_LEN		2
+#define DOT11_MNG_AID_LEN		2
+#define DOT11_MNG_STATUS_LEN		2
+#define DOT11_MNG_TIMESTAMP_LEN		8
+
+/* DUR/ID field in assoc resp is 0xc000 | AID */
+#define DOT11_AID_MASK			0x3fff
+
+/* Reason Codes */
+#define DOT11_RC_RESERVED			0
+#define DOT11_RC_UNSPECIFIED			1	/* Unspecified reason */
+#define DOT11_RC_AUTH_INVAL			2	/* Previous authentication no longer valid */
+#define DOT11_RC_DEAUTH_LEAVING			3	/* Deauthenticated because sending station is
+							   leaving (or has left) IBSS or ESS */
+#define DOT11_RC_INACTIVITY			4	/* Disassociated due to inactivity */
+#define DOT11_RC_BUSY				5	/* Disassociated because AP is unable to handle
+							   all currently associated stations */
+#define DOT11_RC_INVAL_CLASS_2			6	/* Class 2 frame received from
+							   nonauthenticated station */
+#define DOT11_RC_INVAL_CLASS_3			7	/* Class 3 frame received from
+							   nonassociated station */
+#define DOT11_RC_DISASSOC_LEAVING		8	/* Disassociated because sending station is
+							   leaving (or has left) BSS */
+#define DOT11_RC_NOT_AUTH			9	/* Station requesting (re)association is
+							   not authenticated with responding station */
+#define DOT11_RC_MAX				23	/* Reason codes > 23 are reserved */
+
+/* Status Codes */
+#define DOT11_STATUS_SUCCESS			0	/* Successful */
+#define DOT11_STATUS_FAILURE			1	/* Unspecified failure */
+#define DOT11_STATUS_CAP_MISMATCH		10	/* Cannot support all requested capabilities
+							   in the Capability Information field */
+#define DOT11_STATUS_REASSOC_FAIL		11	/* Reassociation denied due to inability to
+							   confirm that association exists */
+#define DOT11_STATUS_ASSOC_FAIL			12	/* Association denied due to reason outside
+							   the scope of this standard */
+#define DOT11_STATUS_AUTH_MISMATCH		13	/* Responding station does not support the
+							   specified authentication algorithm */
+#define DOT11_STATUS_AUTH_SEQ			14	/* Received an Authentication frame with
+							   authentication transaction sequence number
+							   out of expected sequence */
+#define DOT11_STATUS_AUTH_CHALLENGE_FAIL	15	/* Authentication rejected because of challenge failure */
+#define DOT11_STATUS_AUTH_TIMEOUT		16	/* Authentication rejected due to timeout waiting
+							   for next frame in sequence */
+#define DOT11_STATUS_ASSOC_BUSY_FAIL		17	/* Association denied because AP is unable to
+							   handle additional associated stations */
+#define DOT11_STATUS_ASSOC_RATE_MISMATCH	18	/* Association denied due to requesting station
+							   not supporting all of the data rates in the
+							   BSSBasicRateSet parameter */
+#define DOT11_STATUS_ASSOC_SHORT_REQUIRED	19	/* Association denied due to requesting station
+							   not supporting the Short Preamble option */
+#define DOT11_STATUS_ASSOC_PBCC_REQUIRED	20	/* Association denied due to requesting station
+							   not supporting the PBCC Modulation option */
+#define DOT11_STATUS_ASSOC_AGILITY_REQUIRED	21	/* Association denied due to requesting station
+							   not supporting the Channel Agility option */
+#define DOT11_STATUS_ASSOC_SPECTRUM_REQUIRED	22	/* Association denied because Spectrum Management 
+							   capability is required. */
+#define DOT11_STATUS_ASSOC_BAD_POWER_CAP	23	/* Association denied because the info in the 
+							   Power Cap element is unacceptable. */
+#define DOT11_STATUS_ASSOC_BAD_SUP_CHANNELS	24	/* Association denied because the info in the 
+							   Supported Channel element is unacceptable */
+#define DOT11_STATUS_ASSOC_SHORTSLOT_REQUIRED	25	/* Association denied due to requesting station
+							   not supporting the Short Slot Time option */
+#define DOT11_STATUS_ASSOC_ERPBCC_REQUIRED	26	/* Association denied due to requesting station
+							   not supporting the ER-PBCC Modulation option */
+#define DOT11_STATUS_ASSOC_DSSOFDM_REQUIRED	27	/* Association denied due to requesting station
+							   not supporting the DSS-OFDM option */
+
+/* Info Elts, length of INFORMATION portion of Info Elts */
+#define DOT11_MNG_DS_PARAM_LEN			1
+#define DOT11_MNG_IBSS_PARAM_LEN		2
+
+/* TIM Info element has 3 bytes fixed info in INFORMATION field,
+ * followed by 1 to 251 bytes of Partial Virtual Bitmap */
+#define DOT11_MNG_TIM_FIXED_LEN			3
+#define DOT11_MNG_TIM_DTIM_COUNT		0
+#define DOT11_MNG_TIM_DTIM_PERIOD		1
+#define DOT11_MNG_TIM_BITMAP_CTL		2
+#define DOT11_MNG_TIM_PVB			3
+
+/* TLV defines */
+#define TLV_TAG_OFF		0
+#define TLV_LEN_OFF		1
+#define TLV_HDR_LEN		2
+#define TLV_BODY_OFF		2
+
+/* Management Frame Information Element IDs */
+#define DOT11_MNG_SSID_ID			0
+#define DOT11_MNG_RATES_ID			1
+#define DOT11_MNG_FH_PARMS_ID			2
+#define DOT11_MNG_DS_PARMS_ID			3
+#define DOT11_MNG_CF_PARMS_ID			4
+#define DOT11_MNG_TIM_ID			5
+#define DOT11_MNG_IBSS_PARMS_ID			6
+#define DOT11_MNG_COUNTRY_ID			7
+#define DOT11_MNG_HOPPING_PARMS_ID		8
+#define DOT11_MNG_HOPPING_TABLE_ID		9
+#define DOT11_MNG_REQUEST_ID			10
+#define DOT11_MNG_CHALLENGE_ID			16
+#define DOT11_MNG_PWR_CONSTRAINT_ID		32    /* 11H PowerConstraint	*/
+#define DOT11_MNG_PWR_CAP_ID			33    /* 11H PowerCapability	*/
+#define DOT11_MNG_TPC_REQUEST_ID 		34    /* 11H TPC Request	*/
+#define DOT11_MNG_TPC_REPORT_ID			35    /* 11H TPC Report		*/
+#define DOT11_MNG_SUPP_CHANNELS_ID		36    /* 11H Supported Channels	*/
+#define DOT11_MNG_CHANNEL_SWITCH_ID		37    /* 11H ChannelSwitch Announcement*/
+#define DOT11_MNG_MEASURE_REQUEST_ID		38    /* 11H MeasurementRequest	*/
+#define DOT11_MNG_MEASURE_REPORT_ID		39    /* 11H MeasurementReport	*/
+#define DOT11_MNG_QUIET_ID			40    /* 11H Quiet		*/
+#define DOT11_MNG_IBSS_DFS_ID			41    /* 11H IBSS_DFS 		*/
+#define DOT11_MNG_ERP_ID			42
+#define DOT11_MNG_NONERP_ID			47
+#ifdef BCMWPA2
+#define DOT11_MNG_RSN_ID			48
+#endif /* BCMWPA2 */
+#define DOT11_MNG_EXT_RATES_ID			50
+#define DOT11_MNG_WPA_ID			221
+#define DOT11_MNG_PROPR_ID			221
+
+/* ERP info element bit values */
+#define DOT11_MNG_ERP_LEN			1	/* ERP is currently 1 byte long */
+#define DOT11_MNG_NONERP_PRESENT		0x01	/* NonERP (802.11b) STAs are present in the BSS */
+#define DOT11_MNG_USE_PROTECTION		0x02	/* Use protection mechanisms for ERP-OFDM frames */
+#define DOT11_MNG_BARKER_PREAMBLE		0x04	/* Short Preambles: 0 == allowed, 1 == not allowed */
+
+/* Capability Information Field */
+#define DOT11_CAP_ESS				0x0001
+#define DOT11_CAP_IBSS				0x0002
+#define DOT11_CAP_POLLABLE			0x0004
+#define DOT11_CAP_POLL_RQ			0x0008
+#define DOT11_CAP_PRIVACY			0x0010
+#define DOT11_CAP_SHORT				0x0020
+#define DOT11_CAP_PBCC				0x0040
+#define DOT11_CAP_AGILITY			0x0080
+#define DOT11_CAP_SPECTRUM			0x0100
+#define DOT11_CAP_SHORTSLOT			0x0400
+#define DOT11_CAP_CCK_OFDM			0x2000
+
+/* Action Frame Constants */
+#define DOT11_ACTION_CAT_ERR_MASK	0x80
+#define DOT11_ACTION_CAT_SPECT_MNG	0x00
+#define DOT11_ACTION_NOTIFICATION	0x11	/* 17 */
+
+#define DOT11_ACTION_ID_M_REQ		0
+#define DOT11_ACTION_ID_M_REP		1
+#define DOT11_ACTION_ID_TPC_REQ		2
+#define DOT11_ACTION_ID_TPC_REP		3
+#define DOT11_ACTION_ID_CHANNEL_SWITCH	4
+
+/* MLME Enumerations */
+#define DOT11_BSSTYPE_INFRASTRUCTURE		0
+#define DOT11_BSSTYPE_INDEPENDENT		1
+#define DOT11_BSSTYPE_ANY			2
+#define DOT11_SCANTYPE_ACTIVE			0
+#define DOT11_SCANTYPE_PASSIVE			1
+
+/* 802.11 A PHY constants */
+#define APHY_SLOT_TIME		9
+#define APHY_SIFS_TIME		16
+#define APHY_DIFS_TIME		(APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))
+#define APHY_PREAMBLE_TIME	16
+#define APHY_SIGNAL_TIME	4
+#define APHY_SYMBOL_TIME	4
+#define APHY_SERVICE_NBITS	16
+#define APHY_TAIL_NBITS		6
+#define	APHY_CWMIN		15
+
+/* 802.11 B PHY constants */
+#define BPHY_SLOT_TIME		20
+#define BPHY_SIFS_TIME		10
+#define BPHY_DIFS_TIME		50
+#define BPHY_PLCP_TIME		192
+#define BPHY_PLCP_SHORT_TIME	96
+#define	BPHY_CWMIN		31
+
+/* 802.11 G constants */
+#define DOT11_OFDM_SIGNAL_EXTENSION	6
+
+#define PHY_CWMAX		1023
+
+#define	DOT11_MAXNUMFRAGS	16	/* max # fragments per MSDU */
+
+/* dot11Counters Table - 802.11 spec., Annex D */
+typedef struct d11cnt {
+	uint32		txfrag;		/* dot11TransmittedFragmentCount */
+	uint32		txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32		txfail;		/* dot11FailedCount */
+	uint32		txretry;	/* dot11RetryCount */
+	uint32		txretrie;	/* dot11MultipleRetryCount */
+	uint32		rxdup;		/* dot11FrameduplicateCount */
+	uint32		txrts;		/* dot11RTSSuccessCount */
+	uint32		txnocts;	/* dot11RTSFailureCount */
+	uint32		txnoack;	/* dot11ACKFailureCount */
+	uint32		rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32		rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32		rxcrc;		/* dot11FCSErrorCount */
+	uint32		txfrmsnt;	/* dot11TransmittedFrameCount */
+	uint32		rxundec;	/* dot11WEPUndecryptableCount */
+} d11cnt_t;
+
+/* BRCM OUI */
+#define BRCM_OUI		"\x00\x10\x18"
+
+/* BRCM info element */
+struct brcm_ie {
+	uchar	id;		/* 221, DOT11_MNG_PROPR_ID */
+	uchar	len;   
+	uchar 	oui[3];
+	uchar	ver;
+	uchar	assoc;		/*  # of assoc STAs */
+	uchar	flags;		/* misc flags */
+} PACKED;
+#define BRCM_IE_LEN		8
+typedef	struct brcm_ie brcm_ie_t;
+#define BRCM_IE_VER		2
+#define BRCM_IE_LEGACY_AES_VER	1
+
+/* brcm_ie flags */
+#define	BRF_ABCAP		0x1	/* afterburner capable */
+#define	BRF_ABRQRD		0x2	/* afterburner requested */
+#define	BRF_LZWDS		0x4	/* lazy wds enabled */
+#define BRF_ABCOUNTER_MASK	0xf0  /* afterburner wds "state" counter */
+#define BRF_ABCOUNTER_SHIFT	4
+
+#define AB_WDS_TIMEOUT_MAX	15		/* afterburner wds Max count indicating not locally capable */
+#define AB_WDS_TIMEOUT_MIN	1		/* afterburner wds, use zero count as indicating "downrev" */
+
+
+/* OUI for BRCM proprietary IE */
+#define BRCM_PROP_OUI		"\x00\x90\x4C"
+
+/* Vendor IE structure */
+struct vndr_ie {
+	uchar id;
+	uchar len;
+	uchar oui [3];
+	uchar data [1]; 	/* Variable size data */
+}PACKED;
+typedef struct vndr_ie vndr_ie_t;
+
+#define VNDR_IE_HDR_LEN		2	/* id + len field */
+#define VNDR_IE_MIN_LEN		3	/* size of the oui field */
+#define VNDR_IE_MAX_LEN		256
+
+/* WPA definitions */
+#define WPA_VERSION		1
+#define WPA_OUI			"\x00\x50\xF2"
+
+#ifdef BCMWPA2
+#define WPA2_VERSION		1
+#define WPA2_VERSION_LEN	2
+#define WPA2_OUI		"\x00\x0F\xAC"
+#endif /* BCMWPA2 */
+
+#define WPA_OUI_LEN	3
+
+/* RSN authenticated key managment suite */
+#define RSN_AKM_NONE		0	/* None (IBSS) */
+#define RSN_AKM_UNSPECIFIED	1	/* Over 802.1x */
+#define RSN_AKM_PSK		2	/* Pre-shared Key */
+
+
+/* Key related defines */
+#define DOT11_MAX_DEFAULT_KEYS	4	/* number of default keys */
+#define DOT11_MAX_KEY_SIZE	32	/* max size of any key */
+#define DOT11_MAX_IV_SIZE	16	/* max size of any IV */
+#define DOT11_EXT_IV_FLAG	(1<<5)	/* flag to indicate IV is > 4 bytes */
+
+#define WEP1_KEY_SIZE		5	/* max size of any WEP key */
+#define WEP1_KEY_HEX_SIZE	10	/* size of WEP key in hex. */
+#define WEP128_KEY_SIZE		13	/* max size of any WEP key */
+#define WEP128_KEY_HEX_SIZE	26	/* size of WEP key in hex. */
+#define TKIP_MIC_SIZE		8	/* size of TKIP MIC */
+#define TKIP_EOM_SIZE		7	/* max size of TKIP EOM */
+#define TKIP_EOM_FLAG		0x5a	/* TKIP EOM flag byte */
+#define TKIP_KEY_SIZE		32	/* size of any TKIP key */
+#define TKIP_MIC_AUTH_TX	16	/* offset to Authenticator MIC TX key */
+#define TKIP_MIC_AUTH_RX	24	/* offset to Authenticator MIC RX key */
+#define TKIP_MIC_SUP_RX		16	/* offset to Supplicant MIC RX key */
+#define TKIP_MIC_SUP_TX		24	/* offset to Supplicant MIC TX key */
+#define AES_KEY_SIZE		16	/* size of AES key */
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif /* _802_11_H_ */
diff --git a/openwrt/package/wificonf/include/proto/bcmeth.h b/openwrt/package/wificonf/include/proto/bcmeth.h
new file mode 100644
index 0000000000..7a97fe87fa
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/bcmeth.h
@@ -0,0 +1,103 @@
+/*
+ * Broadcom Ethernettype  protocol definitions
+ *
+ * Copyright 2005, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ */
+
+/*
+ * Broadcom Ethernet protocol defines 
+ *
+ */
+
+#ifndef _BCMETH_H_
+#define _BCMETH_H_
+
+/* enable structure packing */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#pragma pack(1)
+#define	PACKED
+#endif
+
+/* ETHER_TYPE_BRCM is defined in ethernet.h */
+
+/*
+ * Following the 2byte BRCM ether_type is a 16bit BRCM subtype field
+ * in one of two formats: (only subtypes 32768-65535 are in use now)
+ *
+ * subtypes 0-32767:
+ *     8 bit subtype (0-127)
+ *     8 bit length in bytes (0-255)
+ *
+ * subtypes 32768-65535:
+ *     16 bit big-endian subtype
+ *     16 bit big-endian length in bytes (0-65535)
+ *
+ * length is the number of additional bytes beyond the 4 or 6 byte header
+ *
+ * Reserved values:
+ * 0 reserved
+ * 5-15 reserved for iLine protocol assignments
+ * 17-126 reserved, assignable
+ * 127 reserved
+ * 32768 reserved
+ * 32769-65534 reserved, assignable
+ * 65535 reserved
+ */
+
+/* 
+ * While adding the subtypes and their specific processing code make sure 
+ * bcmeth_bcm_hdr_t is the first data structure in the user specific data structure definition 
+ */
+
+#define	BCMILCP_SUBTYPE_RATE		1
+#define	BCMILCP_SUBTYPE_LINK		2
+#define	BCMILCP_SUBTYPE_CSA		3
+#define	BCMILCP_SUBTYPE_LARQ		4
+#define BCMILCP_SUBTYPE_VENDOR		5
+#define	BCMILCP_SUBTYPE_FLH		17
+
+#define BCMILCP_SUBTYPE_VENDOR_LONG	32769
+#define BCMILCP_SUBTYPE_CERT		32770
+#define BCMILCP_SUBTYPE_SES		32771
+
+
+#define BCMILCP_BCM_SUBTYPE_RESERVED	0
+#define BCMILCP_BCM_SUBTYPE_EVENT		1
+#define BCMILCP_BCM_SUBTYPE_SES			2
+/*
+The EAPOL type is not used anymore. Instead EAPOL messages are now embedded
+within BCMILCP_BCM_SUBTYPE_EVENT type messages
+*/
+/*#define BCMILCP_BCM_SUBTYPE_EAPOL		3*/
+
+#define BCMILCP_BCM_SUBTYPEHDR_MINLENGTH	8
+#define BCMILCP_BCM_SUBTYPEHDR_VERSION		0
+
+/* These fields are stored in network order */
+typedef  struct bcmeth_hdr
+{
+	uint16	subtype; /* Vendor specific..32769*/
+	uint16	length; 
+	uint8	version; /* Version is 0*/
+	uint8	oui[3]; /* Broadcom OUI*/
+	/* user specific Data */
+	uint16	usr_subtype;
+} PACKED bcmeth_hdr_t;
+
+
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif
diff --git a/openwrt/package/wificonf/include/proto/bcmevent.h b/openwrt/package/wificonf/include/proto/bcmevent.h
new file mode 100644
index 0000000000..3d93f441b9
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/bcmevent.h
@@ -0,0 +1,147 @@
+/*
+ * Broadcom Event  protocol definitions
+ *
+ * Copyright 2005, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ *
+ * Dependencies: proto/bcmeth.h
+ *
+ */
+
+/*
+ * Broadcom Ethernet Events protocol defines 
+ *
+ */
+
+#ifndef _BCMEVENT_H_
+#define _BCMEVENT_H_
+
+/* enable structure packing */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#pragma pack(1)
+#define	PACKED
+#endif
+
+
+
+#define BCM_EVENT_MSG_VERSION	1
+#define BCM_MSG_IFNAME_MAX		16
+
+
+/* flags */
+#define WLC_EVENT_MSG_LINK		0x01
+#define WLC_EVENT_MSG_FLUSHTXQ	0x02
+#define WLC_EVENT_MSG_GROUP		0x04
+
+
+
+/* theses fields are stored in network order */
+typedef struct  
+{
+	uint16	version;
+	uint16	flags;			/* see flags below */
+	uint32	event_type;		/* Message (see below) */
+	uint32	status;			/* Status code (see below) */
+	uint32	reason;			/* Reason code (if applicable) */
+	uint32	auth_type;		/* WLC_E_AUTH */
+	uint32	datalen;		/* data buf */
+	struct ether_addr	addr;	/* Station address (if applicable) */
+	char	ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface*/
+} PACKED wl_event_msg_t;
+
+/* used by driver msgs */
+typedef struct bcm_event {
+	struct ether_header eth;
+	bcmeth_hdr_t		bcm_hdr; 
+	wl_event_msg_t		event;
+	/* data portion follows */
+} PACKED bcm_event_t;
+
+#define BCM_MSG_LEN	(sizeof(bcm_event_t) - sizeof(bcmeth_hdr_t) - sizeof(struct ether_header))
+
+
+
+/* Event messages */
+#define WLC_E_SET_SSID			0	/* indicates status of set SSID */
+#define WLC_E_JOIN			1	/* differentiates join IBSS from found (WLC_E_START) IBSS */
+#define WLC_E_START			2	/* STA founded an IBSS or AP started a BSS */
+#define WLC_E_AUTH			3	/* 802.11 AUTH request */
+#define WLC_E_AUTH_IND			4	/* 802.11 AUTH indication */
+#define WLC_E_DEAUTH			5	/* 802.11 DEAUTH request */
+#define WLC_E_DEAUTH_IND		6	/* 802.11 DEAUTH indication */
+#define WLC_E_ASSOC			7	/* 802.11 ASSOC request */
+#define WLC_E_ASSOC_IND			8	/* 802.11 ASSOC indication */
+#define WLC_E_REASSOC			9	/* 802.11 REASSOC request */
+#define WLC_E_REASSOC_IND		10	/* 802.11 REASSOC indication */
+#define WLC_E_DISASSOC			11	/* 802.11 DISASSOC request */
+#define WLC_E_DISASSOC_IND		12	/* 802.11 DISASSOC indication */
+#define WLC_E_QUIET_START		13	/* 802.11h Quiet period started */
+#define WLC_E_QUIET_END			14	/* 802.11h Quiet period ended */
+#define WLC_E_GOT_BEACONS		15	/* internal use: IBSS mode: saw another STA's BEACONS */
+#define WLC_E_LINK			16	/* generic link indication */
+#define WLC_E_MIC_ERROR			17	/* TKIP MIC error occurred */
+#define WLC_E_NDIS_LINK			18	/* NDIS style link indication */
+#define WLC_E_ROAM			19	/* roam attempt occurred: indicate status & reason for roam */
+#define WLC_E_TXFAIL			20	/* change in dot11FailedCount (txfail) */
+#define WLC_E_PMKID_CACHE		21	/* WPA2 pmkid cache indication */
+#define WLC_E_RETROGRADE_TSF		22	/* current AP's TSF value went backward */
+#define WLC_E_PRUNE				23	/* AP was pruned from join list for reason */
+#define WLC_E_AUTOAUTH			24	/* report AutoAuth table entry match for join attempt */
+#define WLC_E_EAPOL_MSG			25	/* Event encapsulating an EAPOL message */
+#define WLC_E_LAST			26
+
+/* Event status codes */
+#define WLC_E_STATUS_SUCCESS		0
+#define WLC_E_STATUS_FAIL		1
+#define WLC_E_STATUS_TIMEOUT		2
+#define WLC_E_STATUS_NO_NETWORKS	3
+#define WLC_E_STATUS_ABORT		4
+#define WLC_E_STATUS_NO_ACK		5
+#define WLC_E_STATUS_UNSOLICITED	6
+#define WLC_E_STATUS_ATTEMPT		7
+
+/* roam reason codes */
+#define WLC_E_REASON_LOW_RSSI			1
+#define WLC_E_REASON_DEAUTH				2
+#define WLC_E_REASON_DISASSOC			3
+#define WLC_E_REASON_BCNS_LOST			4
+#define WLC_E_REASON_FAST_ROAM_FAILED	5
+
+/* prune reason codes */
+#define WLC_E_PRUNE_ENCR_MISMATCH		1	/* ecryption mismatch */
+#define WLC_E_PRUNE_BCAST_BSSID			2	/* AP uses a broadcast BSSID */
+#define WLC_E_PRUNE_MAC_DENY			3	/* STA's MAC addr is in AP's MAC deny list */
+#define WLC_E_PRUNE_MAC_NA			4	/* STA's MAC addr is not in AP's MAC allow list */
+#define WLC_E_PRUNE_REG_PASSV			5	/* AP not allowed due to regulatory restriction */
+#define WLC_E_PRUNE_SPCT_MGMT			6	/* AP does not support STA locale spectrum mgmt */
+#define WLC_E_PRUNE_RADAR			7	/* AP is on a radar channel of STA locale */
+#define WLC_E_RSN_MISMATCH			8	/* STA does not support AP's RSN */
+#define WLC_E_PRUNE_NO_COMMON_RATES		9	/* No rates in common with AP */
+#define WLC_E_PRUNE_BASIC_RATES			10	/* STA does not support all basic rates of BSS */
+#define WLC_E_PRUNE_CCXFAST_PREVAP		11	/* CCX FAST ROAM: prune previous AP */
+#define WLC_E_PRUNE_CIPHER_NA			12	/* BSS's cipher not supported */
+#define WLC_E_PRUNE_KNOWN_STA			13	/* AP is already known to us as a STA */
+
+/* WLC_SET_CALLBACK data type */
+typedef struct wlc_event_cb {
+	void (*fn)(void *, bcm_event_t *);	/* Callback function */
+	void *context;				/* Passed to callback function */
+} wlc_event_cb_t;
+
+
+
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif
diff --git a/openwrt/package/wificonf/include/proto/bcmip.h b/openwrt/package/wificonf/include/proto/bcmip.h
new file mode 100644
index 0000000000..da2d8f8b60
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/bcmip.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2005, Broadcom Corporation      
+ * All Rights Reserved.                      
+ *                                           
+ * This is UNPUBLISHED PROPRIETARY SOURCE CODE of Broadcom Corporation;         
+ * the contents of this file may not be disclosed to third parties, copied      
+ * or duplicated in any form, in whole or in part, without the prior            
+ * written permission of Broadcom Corporation.                                  
+ *
+ * Fundamental constants relating to IP Protocol
+ *
+ * $Id$
+ */
+
+#ifndef _bcmip_h_
+#define _bcmip_h_
+
+/* IP header */
+#define IPV4_VERIHL_OFFSET	0	/* version and ihl byte offset */
+#define IPV4_TOS_OFFSET		1	/* TOS offset */
+#define IPV4_PROT_OFFSET	9	/* protocol type offset */
+#define IPV4_CHKSUM_OFFSET	10	/* IP header checksum offset */
+#define IPV4_SRC_IP_OFFSET	12	/* src IP addr offset */
+#define IPV4_DEST_IP_OFFSET	16	/* dest IP addr offset */
+
+#define IPV4_VER_MASK	0xf0
+#define IPV4_IHL_MASK	0x0f
+
+#define IPV4_PROT_UDP	17	/* UDP protocol type */
+
+#define IPV4_ADDR_LEN	4	/* IP v4 address length */
+
+#define IPV4_VER_NUM	0x40	/* IP v4 version number */
+
+/* NULL IP address check */
+#define IPV4_ISNULLADDR(a)	((((uint8 *)(a))[0] + ((uint8 *)(a))[1] + \
+				((uint8 *)(a))[2] + ((uint8 *)(a))[3]) == 0)
+
+#define IPV4_ADDR_STR_LEN	16
+
+#endif	/* #ifndef _bcmip_h_ */
+
diff --git a/openwrt/package/wificonf/include/proto/ethernet.h b/openwrt/package/wificonf/include/proto/ethernet.h
new file mode 100644
index 0000000000..c2718a6511
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/ethernet.h
@@ -0,0 +1,171 @@
+/*******************************************************************************
+ * $Id$
+ * Copyright 2005, Broadcom Corporation      
+ * All Rights Reserved.      
+ *       
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY      
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM      
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS      
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.      
+ * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
+ ******************************************************************************/
+
+#ifndef ETHER_ADDR_LEN
+#define _NET_ETHERNET_H_
+
+#ifndef _TYPEDEFS_H_
+#include "typedefs.h"
+#endif
+
+/* enable structure packing */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#pragma pack(1)
+#define	PACKED
+#endif
+
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
+#define	ETHER_ADDR_LEN		6
+
+/*
+ * The number of bytes in the type field.
+ */
+#define	ETHER_TYPE_LEN		2
+
+/*
+ * The number of bytes in the trailing CRC field.
+ */
+#define	ETHER_CRC_LEN		4
+
+/*
+ * The length of the combined header.
+ */
+#define	ETHER_HDR_LEN		(ETHER_ADDR_LEN*2+ETHER_TYPE_LEN)
+
+/*
+ * The minimum packet length.
+ */
+#define	ETHER_MIN_LEN		64
+
+/*
+ * The minimum packet user data length.
+ */
+#define	ETHER_MIN_DATA		46
+
+/*
+ * The maximum packet length.
+ */
+#define	ETHER_MAX_LEN		1518
+
+/*
+ * The maximum packet user data length.
+ */
+#define	ETHER_MAX_DATA		1500
+
+/* ether types */
+#define	ETHER_TYPE_IP		0x0800		/* IP */
+#define ETHER_TYPE_ARP		0x0806		/* ARP */
+#define ETHER_TYPE_8021Q	0x8100		/* 802.1Q */
+#define	ETHER_TYPE_BRCM		0x886c		/* Broadcom Corp. */
+#define	ETHER_TYPE_802_1X	0x888e		/* 802.1x */
+#ifdef BCMWPA2
+#define	ETHER_TYPE_802_1X_PREAUTH	0x88c7	/* 802.1x preauthentication*/
+#endif
+
+/* Broadcom subtype follows ethertype;  First 2 bytes are reserved; Next 2 are subtype; */
+#define	ETHER_BRCM_SUBTYPE_LEN	4		/* Broadcom 4 byte subtype */
+#define	ETHER_BRCM_CRAM		0x1		/* Broadcom subtype cram protocol */
+
+/* ether header */
+#define ETHER_DEST_OFFSET	0		/* dest address offset */
+#define ETHER_SRC_OFFSET	6		/* src address offset */
+#define ETHER_TYPE_OFFSET	12		/* ether type offset */
+
+/*
+ * A macro to validate a length with
+ */
+#define	ETHER_IS_VALID_LEN(foo)	\
+	((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
+
+
+#ifndef __INCif_etherh     /* Quick and ugly hack for VxWorks */
+/*
+ * Structure of a 10Mb/s Ethernet header.
+ */
+struct	ether_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];
+	uint8	ether_shost[ETHER_ADDR_LEN];
+	uint16	ether_type;
+} PACKED;
+
+/*
+ * Structure of a 48-bit Ethernet address.
+ */
+struct	ether_addr {
+	uint8 octet[ETHER_ADDR_LEN];
+} PACKED;
+#endif
+
+/*
+ * Takes a pointer, sets locally admininistered 
+ * address bit in the 48-bit Ethernet address.
+ */
+#define ETHER_SET_LOCALADDR(ea) ( ((uint8 *)(ea))[0] = \
+				(((uint8 *)(ea))[0] | 2) )
+
+/*
+ * Takes a pointer, returns true if a 48-bit multicast address
+ * (including broadcast, since it is all ones)
+ */
+#define ETHER_ISMULTI(ea) (((uint8 *)(ea))[0] & 1)
+
+
+/* compare two ethernet addresses - assumes the pointers can be referenced as shorts */
+#define	ether_cmp(a, b)	( \
+	!(((short*)a)[0] == ((short*)b)[0]) | \
+	!(((short*)a)[1] == ((short*)b)[1]) | \
+	!(((short*)a)[2] == ((short*)b)[2]))
+
+/* copy an ethernet address - assumes the pointers can be referenced as shorts */
+#define	ether_copy(s, d) { \
+	((short*)d)[0] = ((short*)s)[0]; \
+	((short*)d)[1] = ((short*)s)[1]; \
+	((short*)d)[2] = ((short*)s)[2]; }
+
+/*
+ * Takes a pointer, returns true if a 48-bit broadcast (all ones)
+ */
+#define ETHER_ISBCAST(ea) ((((uint8 *)(ea))[0] &		\
+			    ((uint8 *)(ea))[1] &		\
+			    ((uint8 *)(ea))[2] &		\
+			    ((uint8 *)(ea))[3] &		\
+			    ((uint8 *)(ea))[4] &		\
+			    ((uint8 *)(ea))[5]) == 0xff)
+
+static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
+
+/*
+ * Takes a pointer, returns true if a 48-bit null address (all zeros)
+ */
+#define ETHER_ISNULLADDR(ea) ((((uint8 *)(ea))[0] |		\
+			    ((uint8 *)(ea))[1] |		\
+			    ((uint8 *)(ea))[2] |		\
+			    ((uint8 *)(ea))[3] |		\
+			    ((uint8 *)(ea))[4] |		\
+			    ((uint8 *)(ea))[5]) == 0)
+
+/* Differentiated Services Codepoint - upper 6 bits of tos in iphdr */
+#define	DSCP_MASK		0xFC		/* upper 6 bits */
+#define	DSCP_SHIFT		2
+#define	DSCP_WME_PRI_MASK	0xE0		/* upper 3 bits */
+#define	DSCP_WME_PRI_SHIFT	5
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif /* _NET_ETHERNET_H_ */
diff --git a/openwrt/package/wificonf/include/proto/vlan.h b/openwrt/package/wificonf/include/proto/vlan.h
new file mode 100644
index 0000000000..ba136e9ed6
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/vlan.h
@@ -0,0 +1,50 @@
+/*
+ * 802.1Q VLAN protocol definitions
+ *
+ * Copyright 2005, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id$
+ */
+
+#ifndef _vlan_h_
+#define _vlan_h_
+
+/* enable structure packing */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#pragma pack(1)
+#define	PACKED
+#endif
+
+#define VLAN_VID_MASK		0xfff	/* low 12 bits are vlan id */
+#define	VLAN_CFI_SHIFT		12	/* canonical format indicator bit */
+#define VLAN_PRI_SHIFT		13	/* user priority */
+
+#define VLAN_PRI_MASK		7	/* 3 bits of priority */
+
+#define	VLAN_TAG_LEN		4
+#define	VLAN_TAG_OFFSET		(2 * ETHER_ADDR_LEN)
+
+struct ethervlan_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];
+	uint8	ether_shost[ETHER_ADDR_LEN];
+	uint16	vlan_type;		/* 0x8100 */
+	uint16	vlan_tag;		/* priority, cfi and vid */
+	uint16	ether_type;
+};
+
+#define	ETHERVLAN_HDR_LEN	(ETHER_HDR_LEN + VLAN_TAG_LEN)
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif /* _vlan_h_ */
diff --git a/openwrt/package/wificonf/include/proto/wpa.h b/openwrt/package/wificonf/include/proto/wpa.h
new file mode 100644
index 0000000000..db49b76308
--- /dev/null
+++ b/openwrt/package/wificonf/include/proto/wpa.h
@@ -0,0 +1,140 @@
+/*
+ * Fundamental types and constants relating to WPA
+ *
+ * Copyright 2005, Broadcom Corporation      
+ * All Rights Reserved.      
+ *       
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY      
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM      
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS      
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.      
+ *
+ * $Id$
+ */
+
+#ifndef _proto_wpa_h_
+#define _proto_wpa_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+
+/* enable structure packing */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#pragma pack(1)
+#define	PACKED
+#endif
+
+/* Reason Codes */
+
+/* 10 and 11 are from TGh. */
+#define DOT11_RC_BAD_PC				10	/* Unacceptable power capability element */
+#define DOT11_RC_BAD_CHANNELS			11	/* Unacceptable supported channels element */
+/* 12 is unused */
+/* 13 through 23 taken from P802.11i/D3.0, November 2002 */
+#define DOT11_RC_INVALID_WPA_IE			13	/* Invalid info. element */
+#define DOT11_RC_MIC_FAILURE			14	/* Michael failure */
+#define DOT11_RC_4WH_TIMEOUT			15	/* 4-way handshake timeout */
+#define DOT11_RC_GTK_UPDATE_TIMEOUT		16	/* Group key update timeout */
+#define DOT11_RC_WPA_IE_MISMATCH		17	/* WPA IE in 4-way handshake differs from (re-)assoc. request/probe response */
+#define DOT11_RC_INVALID_MC_CIPHER		18	/* Invalid multicast cipher */
+#define DOT11_RC_INVALID_UC_CIPHER		19	/* Invalid unicast cipher */
+#define DOT11_RC_INVALID_AKMP			20	/* Invalid authenticated key management protocol */
+#define DOT11_RC_BAD_WPA_VERSION		21	/* Unsupported WPA version */
+#define DOT11_RC_INVALID_WPA_CAP		22	/* Invalid WPA IE capabilities */
+#define DOT11_RC_8021X_AUTH_FAIL		23	/* 802.1X authentication failure */
+
+#define WPA2_PMKID_LEN	16
+
+/* WPA IE fixed portion */
+typedef struct
+{
+	uint8 tag;	/* TAG */
+	uint8 length;	/* TAG length */
+	uint8 oui[3];	/* IE OUI */
+	uint8 oui_type;	/* OUI type */
+	struct {
+		uint8 low;
+		uint8 high;
+	} PACKED version;	/* IE version */
+} PACKED wpa_ie_fixed_t;
+#define WPA_IE_OUITYPE_LEN	4
+#define WPA_IE_FIXED_LEN	8
+#define WPA_IE_TAG_FIXED_LEN	6
+
+typedef struct {
+	uint8 tag;	/* TAG */
+	uint8 length;	/* TAG length */
+	struct {
+		uint8 low;
+		uint8 high;
+	} PACKED version;	/* IE version */
+} PACKED wpa_rsn_ie_fixed_t;
+#define WPA_RSN_IE_FIXED_LEN	4
+#define WPA_RSN_IE_TAG_FIXED_LEN	2
+typedef uint8 wpa_pmkid_t[WPA2_PMKID_LEN];
+
+/* WPA suite/multicast suite */
+typedef struct
+{
+	uint8 oui[3];
+	uint8 type;
+} PACKED wpa_suite_t, wpa_suite_mcast_t;
+#define WPA_SUITE_LEN	4
+
+/* WPA unicast suite list/key management suite list */
+typedef struct
+{
+	struct {
+		uint8 low;
+		uint8 high;
+	} PACKED count;
+	wpa_suite_t list[1];
+} PACKED wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
+#define WPA_IE_SUITE_COUNT_LEN	2
+typedef struct
+{
+	struct {
+		uint8 low;
+		uint8 high;
+	} PACKED count;
+	wpa_pmkid_t list[1];
+} PACKED wpa_pmkid_list_t;
+
+/* WPA cipher suites */
+#define WPA_CIPHER_NONE		0	/* None */
+#define WPA_CIPHER_WEP_40	1	/* WEP (40-bit) */
+#define WPA_CIPHER_TKIP		2	/* TKIP: default for WPA */
+#define WPA_CIPHER_AES_OCB	3	/* AES (OCB) */
+#define WPA_CIPHER_AES_CCM	4	/* AES (CCM) */
+#define WPA_CIPHER_WEP_104	5	/* WEP (104-bit) */
+
+#define IS_WPA_CIPHER(cipher)	((cipher) == WPA_CIPHER_NONE || \
+				 (cipher) == WPA_CIPHER_WEP_40 || \
+				 (cipher) == WPA_CIPHER_WEP_104 || \
+				 (cipher) == WPA_CIPHER_TKIP || \
+				 (cipher) == WPA_CIPHER_AES_OCB || \
+				 (cipher) == WPA_CIPHER_AES_CCM)
+
+/* WPA TKIP countermeasures parameters */
+#define WPA_TKIP_CM_DETECT	60	/* multiple MIC failure window (seconds) */
+#define WPA_TKIP_CM_BLOCK	60	/* countermeasures active window (seconds) */
+
+/* WPA capabilities defined in 802.11i */
+#define WPA_CAP_4_REPLAY_CNTRS		2
+#define WPA_CAP_16_REPLAY_CNTRS		3
+#define WPA_CAP_REPLAY_CNTR_SHIFT	2
+#define WPA_CAP_REPLAY_CNTR_MASK	0x000c
+
+/* WPA Specific defines */
+#define WPA_CAP_LEN	2
+
+#define	WPA_CAP_WPA2_PREAUTH		1
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif /* _proto_wpa_h_ */
diff --git a/openwrt/package/wificonf/include/wlioctl.h b/openwrt/package/wificonf/include/wlioctl.h
new file mode 100644
index 0000000000..43b4e02ea9
--- /dev/null
+++ b/openwrt/package/wificonf/include/wlioctl.h
@@ -0,0 +1,1238 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright 2005, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id$
+ */
+
+#ifndef _wlioctl_h_
+#define	_wlioctl_h_
+
+#include "typedefs.h"
+#include "proto/wpa.h"
+#include "proto/ethernet.h"
+#include "proto/bcmeth.h"
+#include "proto/bcmevent.h"
+#include "proto/802.11.h"
+
+/* require default structure packing */
+#if !defined(__GNUC__)
+#pragma pack(push,8)
+#endif
+
+#define WL_NUMRATES		255	/* max # of rates in a rateset */
+
+typedef struct wl_rateset {
+	uint32	count;			/* # rates in this set */
+	uint8	rates[WL_NUMRATES];	/* rates in 500kbps units w/hi bit set if basic */
+} wl_rateset_t;
+
+#define WL_CHANSPEC_CHAN_MASK	0x0fff
+#define WL_CHANSPEC_BAND_MASK	0xf000
+#define WL_CHANSPEC_BAND_SHIFT	12
+#define WL_CHANSPEC_BAND_A	0x1000
+#define WL_CHANSPEC_BAND_B	0x2000
+
+/*
+ * Per-bss information structure.
+ */
+
+#define	WL_BSS_INFO_VERSION		107	/* current version of wl_bss_info struct */
+
+typedef struct wl_bss_info {
+	uint32		version;	/* version field */
+	uint32		length;		/* byte length of data in this record, starting at version and including IEs */
+	struct ether_addr BSSID;
+	uint16		beacon_period;	/* units are Kusec */
+	uint16		capability;	/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	struct {
+		uint	count;		/* # rates in this set */
+		uint8	rates[16];	/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;			/* supported rates */
+	uint8		channel;	/* Channel no. */
+	uint16		atim_window;	/* units are Kusec */
+	uint8		dtim_period;	/* DTIM period */
+	int16		RSSI;		/* receive signal strength (in dBm) */
+	int8		phy_noise;	/* noise (in dBm) */
+	uint32		ie_length;	/* byte length of Information Elements */
+	/* variable length Information Elements */
+} wl_bss_info_t;
+
+typedef struct wlc_ssid {
+	uint32		SSID_len;
+	uchar		SSID[32];
+} wlc_ssid_t;
+
+typedef struct wl_scan_params {
+	wlc_ssid_t ssid;	/* default is {0, ""} */
+	struct ether_addr bssid;/* default is bcast */
+	int8 bss_type;		/* default is any, DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT */
+	int8 scan_type;		/* -1 use default, DOT11_SCANTYPE_ACTIVE/PASSIVE */
+	int32 nprobes;		/* -1 use default, number of probes per channel */
+	int32 active_time;	/* -1 use default, dwell time per channel for active scanning */
+	int32 passive_time;	/* -1 use default, dwell time per channel for passive scanning */
+	int32 home_time;	/* -1 use default, dwell time for the home channel between channel scans */
+	int32 channel_num;	/* 0 use default (all available channels), count of channels in channel_list */
+	uint16 channel_list[1];	/* list of chanspecs */
+} wl_scan_params_t;
+/* size of wl_scan_params not including variable length array */
+#define WL_SCAN_PARAMS_FIXED_SIZE 64
+
+typedef struct wl_scan_results {
+	uint32 buflen;
+	uint32 version;
+	uint32 count;
+	wl_bss_info_t bss_info[1];
+} wl_scan_results_t;
+/* size of wl_scan_results not including variable length array */
+#define WL_SCAN_RESULTS_FIXED_SIZE 12
+
+/* uint32 list */
+typedef struct wl_uint32_list {
+	/* in - # of elements, out - # of entries */
+	uint32 count;
+	/* variable length uint32 list */
+	uint32 element[1];
+} wl_uint32_list_t;
+
+#define WLC_CNTRY_BUF_SZ	4		/* Country string is 3 bytes + NULL */
+
+typedef struct wl_channels_in_country {
+	uint32 buflen;
+	uint32 band;
+	char country_abbrev[WLC_CNTRY_BUF_SZ];
+	uint32 count;
+	uint32 channel[1];
+} wl_channels_in_country_t;
+
+typedef struct wl_country_list {
+	uint32 buflen;
+	uint32 band_set;
+	uint32 band;
+	uint32 count;
+	char country_abbrev[1];
+} wl_country_list_t;
+
+#define WL_RM_TYPE_BASIC	1
+#define WL_RM_TYPE_CCA		2
+#define WL_RM_TYPE_RPI		3
+
+#define WL_RM_FLAG_PARALLEL	(1<<0)
+
+#define WL_RM_FLAG_LATE		(1<<1)
+#define WL_RM_FLAG_INCAPABLE	(1<<2)
+#define WL_RM_FLAG_REFUSED	(1<<3)
+
+typedef struct wl_rm_req_elt {
+	int8	type;
+	int8	flags;
+	uint16	chanspec;
+	uint32	token;		/* token for this measurement */
+	uint32	tsf_h;		/* TSF high 32-bits of Measurement start time */
+	uint32	tsf_l;		/* TSF low 32-bits */
+	uint32	dur;		/* TUs */
+} wl_rm_req_elt_t;
+
+typedef struct wl_rm_req {
+	uint32	token;		/* overall measurement set token */
+	uint32	count;		/* number of measurement reqests */
+	wl_rm_req_elt_t	req[1];	/* variable length block of requests */
+} wl_rm_req_t;
+#define WL_RM_REQ_FIXED_LEN	8
+
+typedef struct wl_rm_rep_elt {
+	int8	type;
+	int8	flags;
+	uint16	chanspec;
+	uint32	token;		/* token for this measurement */
+	uint32	tsf_h;		/* TSF high 32-bits of Measurement start time */
+	uint32	tsf_l;		/* TSF low 32-bits */
+	uint32	dur;		/* TUs */
+	uint32	len;		/* byte length of data block */
+	uint8	data[1];	/* variable length data block */
+} wl_rm_rep_elt_t;
+#define WL_RM_REP_ELT_FIXED_LEN	24	/* length excluding data block */
+
+#define WL_RPI_REP_BIN_NUM 8
+typedef struct wl_rm_rpi_rep {
+	uint8	rpi[WL_RPI_REP_BIN_NUM];
+	int8	rpi_max[WL_RPI_REP_BIN_NUM];
+} wl_rm_rpi_rep_t;
+
+typedef struct wl_rm_rep {
+	uint32	token;		/* overall measurement set token */
+	uint32	len;		/* length of measurement report block */
+	wl_rm_rep_elt_t	rep[1];	/* variable length block of reports */
+} wl_rm_rep_t;
+#define WL_RM_REP_FIXED_LEN	8
+
+
+#define WLC_MAX_KEY_SIZE	32	/* max size of any key */
+#define WLC_MAX_IV_SIZE		16	/* max size of any IV */
+#define WLC_EXT_IV_FLAG		(1<<5)	/* flag to indicate IV is > 4 bytes */
+#define WLC_MAX_DEFAULT_KEYS	4	/* # of default WEP keys */
+#define WLC_MAX_KEYS		54	/* Max # of WEP keys */
+#define WLC_WEP1_KEY_SIZE	5	/* max size of any WEP key */
+#define WLC_WEP1_KEY_HEX_SIZE	10	/* size of WEP key in hex. */
+#define WLC_WEP128_KEY_SIZE	13	/* max size of any WEP key */
+#define WLC_WEP128_KEY_HEX_SIZE	26	/* size of WEP key in hex. */
+#define WLC_TKIP_MIC_SIZE	8	/* size of TKIP MIC */
+#define WLC_TKIP_EOM_SIZE	7	/* max size of TKIP EOM */
+#define WLC_TKIP_EOM_FLAG	0x5a	/* TKIP EOM flag byte */
+#define WLC_TKIP_KEY_SIZE	32	/* size of any TKIP key */
+#define WLC_TKIP_MIC_AUTH_TX	16	/* offset to Authenticator MIC TX key */
+#define WLC_TKIP_MIC_AUTH_RX	24	/* offset to Authenticator MIC RX key */
+#define WLC_TKIP_MIC_SUP_RX	16	/* offset to Supplicant MIC RX key */
+#define WLC_TKIP_MIC_SUP_TX	24	/* offset to Supplicant MIC TX key */
+#define WLC_TKIP_P1_KEY_SIZE	10	/* size of TKHash Phase1 output, in bytes */
+#define WLC_TKIP_P2_KEY_SIZE	16	/* size of TKHash Phase2 output */
+#define WLC_AES_KEY_SIZE	16	/* size of AES key */
+
+
+typedef enum sup_auth_status {
+	WLC_SUP_DISCONNECTED = 0,
+	WLC_SUP_CONNECTING,
+	WLC_SUP_IDREQUIRED,
+	WLC_SUP_AUTHENTICATING,
+	WLC_SUP_AUTHENTICATED,
+	WLC_SUP_KEYXCHANGE,
+	WLC_SUP_KEYED,
+	WLC_SUP_TIMEOUT
+} sup_auth_status_t;
+
+
+/* Enumerate crypto algorithms */
+#define	CRYPTO_ALGO_OFF			0
+#define	CRYPTO_ALGO_WEP1		1
+#define	CRYPTO_ALGO_TKIP		2
+#define	CRYPTO_ALGO_WEP128		3
+#define CRYPTO_ALGO_AES_CCM		4
+#define CRYPTO_ALGO_AES_OCB_MSDU	5
+#define CRYPTO_ALGO_AES_OCB_MPDU	6
+#define CRYPTO_ALGO_NALG		7
+
+#define WSEC_GEN_MIC_ERROR	0x0001
+#define WSEC_GEN_REPLAY		0x0002
+
+#define WL_SOFT_KEY	(1 << 0)	/* Indicates this key is using soft encrypt */
+#define WL_PRIMARY_KEY	(1 << 1)	/* Indicates this key is the primary (ie tx) key */
+#define WL_KF_RES_4	(1 << 4)	/* Reserved for backward compat */
+#define WL_KF_RES_5	(1 << 5)	/* Reserved for backward compat */
+
+
+typedef struct wlc_tkip_info {
+	uint16		phase1[WLC_TKIP_P1_KEY_SIZE/sizeof(uint16)];	/* tkhash phase1 result */
+	uint8		phase2[WLC_TKIP_P2_KEY_SIZE];	/* tkhash phase2 result */
+	uint32		micl;
+	uint32		micr;
+} tkip_info_t;
+
+typedef struct _wsec_iv {
+	uint32		hi;	/* upper 32 bits of IV */
+	uint16		lo;	/* lower 16 bits of IV */
+} wsec_iv_t;
+
+typedef struct wsec_key {
+	uint32		index;		/* key index */
+	uint32		len;		/* key length */
+	uint8		data[WLC_MAX_KEY_SIZE];	/* key data */
+	tkip_info_t	tkip_tx;	/* tkip transmit state */
+	tkip_info_t	tkip_rx;	/* tkip receive state */
+	uint32		algo;		/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+	uint32		flags;		/* misc flags */
+	uint32 		algo_hw;	/* cache for hw register*/
+	uint32 		aes_mode;	/* cache for hw register*/
+	int		iv_len;		/* IV length */		
+	int		iv_initialized;	/* has IV been initialized already? */		
+	int		icv_len;	/* ICV length */
+	wsec_iv_t	rxiv;		/* Rx IV */
+	wsec_iv_t	txiv;		/* Tx IV */
+	struct ether_addr ea;		/* per station */
+} wsec_key_t;
+
+
+
+typedef struct wl_wsec_key {
+	uint32		index;		/* key index */
+	uint32		len;		/* key length */
+	uint8		data[DOT11_MAX_KEY_SIZE];	/* key data */
+	uint32		pad_1[18];
+	uint32		algo;		/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+	uint32		flags;		/* misc flags */
+	uint32		pad_2[2];
+	int		pad_3;
+	int		iv_initialized;	/* has IV been initialized already? */
+	int		pad_4;
+	/* Rx IV */
+	struct {
+		uint32	hi;		/* upper 32 bits of IV */
+		uint16	lo;		/* lower 16 bits of IV */
+	} rxiv;
+	uint32		pad_5[2];
+	struct ether_addr ea;		/* per station */
+} wl_wsec_key_t;
+
+
+#define WSEC_MIN_PSK_LEN	8
+#define WSEC_MAX_PSK_LEN	64
+
+/* Flag for key material needing passhash'ing */
+#define WSEC_PASSPHRASE		(1<<0)
+
+/* recepticle for WLC_SET_WSEC_PMK parameter */
+typedef struct {
+	ushort	key_len;		/* octets in key material */
+	ushort	flags;			/* key handling qualification */
+	uint8	key[WSEC_MAX_PSK_LEN];	/* PMK material */
+} wsec_pmk_t;
+
+/* wireless security bitvec */
+#define WEP_ENABLED		0x0001
+#define TKIP_ENABLED		0x0002
+#define AES_ENABLED		0x0004
+#define WSEC_SWFLAG		0x0008
+#define SES_OW_ENABLED		0x0040	/* to go into transition mode without setting wep */
+
+/* WPA authentication mode bitvec */
+#define WPA_AUTH_DISABLED	0x0000	/* Legacy (i.e., non-WPA) */
+#define WPA_AUTH_NONE		0x0001	/* none (IBSS) */
+#define WPA_AUTH_UNSPECIFIED	0x0002	/* over 802.1x */
+#define WPA_AUTH_PSK		0x0004	/* Pre-shared key */
+/*#define WPA_AUTH_8021X 0x0020*/	/* 802.1x, reserved */
+
+#define WPA2_AUTH_UNSPECIFIED	0x0040	/* over 802.1x */
+#define WPA2_AUTH_PSK		0x0080	/* Pre-shared key */
+
+
+
+/* pmkid */
+#define	MAXPMKID		16	
+
+typedef struct _pmkid
+{
+	struct ether_addr	BSSID;
+	uint8			PMKID[WPA2_PMKID_LEN];
+} pmkid_t;
+
+typedef struct _pmkid_list
+{
+	uint32	npmkid;
+	pmkid_t	pmkid[1];
+} pmkid_list_t;
+
+typedef struct _pmkid_cand {
+	struct ether_addr	BSSID;
+	uint8			preauth;
+} pmkid_cand_t;
+
+typedef struct _pmkid_cand_list {
+	uint32	npmkid_cand;
+	pmkid_cand_t	pmkid_cand[1];
+} pmkid_cand_list_t;
+
+
+typedef struct wl_led_info {
+	uint32		index;		/* led index */
+	uint32		behavior;
+	bool		activehi;
+} wl_led_info_t;
+
+typedef struct wlc_assoc_info {
+	uint32		req_len;
+	uint32		resp_len;
+	uint32		flags;
+	struct dot11_assoc_req req;
+	struct ether_addr reassoc_bssid; /* used in reassoc's */
+	struct dot11_assoc_resp resp;
+} wl_assoc_info_t;
+/* flags */
+#define WLC_ASSOC_REQ_IS_REASSOC 0x01 /* assoc req was actually a reassoc */
+/* srom read/write struct passed through ioctl */
+typedef struct {
+	uint	byteoff;		/* byte offset */
+	uint	nbytes;		/* number of bytes */
+	uint16 buf[1];
+} srom_rw_t;
+
+/* R_REG and W_REG struct passed through ioctl */
+typedef struct {
+	uint32	byteoff;	/* byte offset of the field in d11regs_t */
+	uint32	val;		/* read/write value of the field */
+	uint32	size;		/* sizeof the field */
+	uint	band;		/* band (optional) */
+} rw_reg_t;
+
+/* Structure used by GET/SET_ATTEN ioctls */
+typedef struct {
+	uint16	auto_ctrl;	/* 1: Automatic control, 0: overriden */
+	uint16	bb;		/* Baseband attenuation */
+	uint16	radio;		/* Radio attenuation */
+	uint16	txctl1;		/* Radio TX_CTL1 value */
+} atten_t;
+
+/* Used to get specific STA parameters */
+typedef struct {
+	uint32	val;
+	struct ether_addr ea;
+} scb_val_t;
+
+
+/* Event data type */
+typedef struct wlc_event {
+	wl_event_msg_t event; /* encapsulated event */	
+	struct ether_addr *addr; /* used to keep a trace of the potential present of
+							an address in wlc_event_msg_t */
+	void *data;			/* used to hang additional data on an event */
+	struct wlc_event *next;	/* enables ordered list of pending events */
+} wlc_event_t;
+
+#define BCM_MAC_STATUS_INDICATION           (0x40010200L)
+
+typedef struct {
+	uint16		ver;		/* version of this struct */
+	uint16		len;		/* length in bytes of this structure */
+	uint16		cap;		/* sta's advertized capabilities */
+	uint32		flags;		/* flags defined below */
+	uint32		idle;		/* time since data pkt rx'd from sta */
+	struct ether_addr	ea;	/* Station address */
+	wl_rateset_t	rateset;	/* rateset in use */
+	uint32		in;		/* seconds elapsed since associated */
+	uint32		listen_interval_inms; /* Min Listen interval in ms for this STA*/
+} sta_info_t;
+
+#define WL_STA_VER	2
+
+/* flags fields */
+#define WL_STA_BRCM	0x01
+#define WL_STA_WME	0x02
+#define WL_STA_ABCAP	0x04
+#define WL_STA_AUTHE	0x08
+#define WL_STA_ASSOC	0x10
+#define WL_STA_AUTHO	0x20
+#define WL_STA_WDS	0x40
+#define WL_WDS_LINKUP	0x80
+
+/*
+ * Country locale determines which channels are available to us.
+ */
+typedef enum _wlc_locale {
+	WLC_WW = 0,	/* Worldwide */
+	WLC_THA,	/* Thailand */
+	WLC_ISR,	/* Israel */
+	WLC_JDN,	/* Jordan */
+	WLC_PRC,	/* China */
+	WLC_JPN,	/* Japan */
+	WLC_FCC,	/* USA */
+	WLC_EUR,	/* Europe */
+	WLC_USL,	/* US Low Band only */
+	WLC_JPH,	/* Japan High Band only */
+	WLC_ALL,	/* All the channels in this band */
+	WLC_11D,	/* Represents locale recieved by 11d beacons */
+	WLC_LAST_LOCALE,
+	WLC_UNDEFINED_LOCALE = 0xf
+} wlc_locale_t;
+
+/* channel encoding */
+typedef struct channel_info {
+	int hw_channel;
+	int target_channel;
+	int scan_channel;
+} channel_info_t;
+
+/* For ioctls that take a list of MAC addresses */
+struct maclist {
+	uint count;			/* number of MAC addresses */
+	struct ether_addr ea[1];	/* variable length array of MAC addresses */
+};
+
+/* get pkt count struct passed through ioctl */
+typedef struct get_pktcnt {
+	uint rx_good_pkt;
+	uint rx_bad_pkt;
+	uint tx_good_pkt;
+	uint tx_bad_pkt;
+} get_pktcnt_t;
+
+/* Linux network driver ioctl encoding */
+typedef struct wl_ioctl {
+	uint cmd;	/* common ioctl definition */
+	void *buf;	/* pointer to user buffer */
+	uint len;	/* length of user buffer */
+	bool set;	/* get or set request (optional) */
+	uint used;	/* bytes read or written (optional) */
+	uint needed;	/* bytes needed (optional) */
+} wl_ioctl_t;
+
+/*
+ * Structure for passing hardware and software
+ * revision info up from the driver.
+ */
+typedef struct wlc_rev_info {
+	uint		vendorid;	/* PCI vendor id */
+	uint		deviceid;	/* device id of chip */
+	uint		radiorev;	/* radio revision */
+	uint		chiprev;	/* chip revision */
+	uint		corerev;	/* core revision */
+	uint		boardid;	/* board identifier (usu. PCI sub-device id) */
+	uint		boardvendor;	/* board vendor (usu. PCI sub-vendor id) */
+	uint		boardrev;	/* board revision */
+	uint		driverrev;	/* driver version */
+	uint		ucoderev;	/* microcode version */
+	uint		bus;		/* bus type */
+	uint		chipnum;	/* chip number */
+} wlc_rev_info_t;
+
+#define WL_BRAND_MAX 10
+typedef struct wl_instance_info {
+	uint instance;
+	char brand[WL_BRAND_MAX];
+} wl_instance_info_t;
+
+/* check this magic number */
+#define WLC_IOCTL_MAGIC		0x14e46c77
+
+/* bump this number if you change the ioctl interface */
+#define WLC_IOCTL_VERSION	1
+
+#define	WLC_IOCTL_MAXLEN	8192		/* max length ioctl buffer required */
+#define	WLC_IOCTL_SMLEN		256		/* "small" length ioctl buffer required */
+
+/* common ioctl definitions */
+#define WLC_GET_MAGIC				0
+#define WLC_GET_VERSION				1
+#define WLC_UP						2
+#define WLC_DOWN					3
+#define WLC_DUMP					6
+#define WLC_GET_MSGLEVEL			7
+#define WLC_SET_MSGLEVEL			8
+#define WLC_GET_PROMISC				9
+#define WLC_SET_PROMISC				10
+#define WLC_GET_RATE				12
+/* #define WLC_SET_RATE				13 */ /* no longer supported */
+#define WLC_GET_INSTANCE			14
+#define WLC_GET_FRAG				15 /* no longer supported in the new driver */
+#define WLC_SET_FRAG				16 /* no longer supported in the new driver */
+#define WLC_GET_RTS				17 /* no longer supported in the new driver */
+#define WLC_SET_RTS				18 /* no longer supported in the new driver */
+#define WLC_GET_INFRA				19
+#define WLC_SET_INFRA				20
+#define WLC_GET_AUTH				21
+#define WLC_SET_AUTH				22
+#define WLC_GET_BSSID				23
+#define WLC_SET_BSSID				24
+#define WLC_GET_SSID				25
+#define WLC_SET_SSID				26
+#define WLC_RESTART				27
+#define WLC_DUMP_SCB				28 
+#define WLC_GET_CHANNEL				29
+#define WLC_SET_CHANNEL				30
+#define WLC_GET_SRL				31
+#define WLC_SET_SRL				32
+#define WLC_GET_LRL				33
+#define WLC_SET_LRL				34
+#define WLC_GET_PLCPHDR				35
+#define WLC_SET_PLCPHDR				36
+#define WLC_GET_RADIO				37
+#define WLC_SET_RADIO				38
+#define WLC_GET_PHYTYPE				39
+#define WLC_DUMP_RATE				40
+#define WLC_SET_RATE_PARAMS			41
+#define WLC_GET_WEP				42
+#define WLC_SET_WEP				43
+#define WLC_GET_KEY				44
+#define WLC_SET_KEY				45
+#define WLC_GET_REGULATORY			46
+#define WLC_SET_REGULATORY			47
+#define WLC_GET_PASSIVE				48
+#define WLC_SET_PASSIVE				49
+#define WLC_SCAN				50
+#define WLC_SCAN_RESULTS			51
+#define WLC_DISASSOC				52
+#define WLC_REASSOC				53
+#define WLC_GET_ROAM_TRIGGER			54
+#define WLC_SET_ROAM_TRIGGER			55
+#define WLC_GET_ROAM_DELTA			56
+#define WLC_SET_ROAM_DELTA			57
+#define WLC_GET_ROAM_SCAN_PERIOD		58
+#define WLC_SET_ROAM_SCAN_PERIOD		59
+#define WLC_EVM					60
+#define WLC_GET_TXANT				61
+#define WLC_SET_TXANT				62
+#define WLC_GET_ANTDIV				63
+#define WLC_SET_ANTDIV				64
+#define WLC_GET_TXPWR				65
+#define WLC_SET_TXPWR				66
+#define WLC_GET_CLOSED				67
+#define WLC_SET_CLOSED				68
+#define WLC_GET_MACLIST				69
+#define WLC_SET_MACLIST				70
+#define WLC_GET_RATESET				71
+#define WLC_SET_RATESET				72
+#define WLC_GET_LOCALE				73
+// #define WLC_SET_LOCALE				74
+#define WLC_GET_BCNPRD				75
+#define WLC_SET_BCNPRD				76
+#define WLC_GET_DTIMPRD				77
+#define WLC_SET_DTIMPRD				78
+#define WLC_GET_SROM				79
+#define WLC_SET_SROM				80
+#define WLC_GET_WEP_RESTRICT			81
+#define WLC_SET_WEP_RESTRICT			82
+#define WLC_GET_COUNTRY				83
+#define WLC_SET_COUNTRY				84
+#define WLC_GET_PM				85
+#define WLC_SET_PM				86
+#define WLC_GET_WAKE				87
+#define WLC_SET_WAKE				88
+#define	WLC_GET_D11CNTS				89
+#define WLC_GET_FORCELINK			90	/* ndis only */
+#define WLC_SET_FORCELINK			91	/* ndis only */
+#define WLC_FREQ_ACCURACY			92
+#define WLC_CARRIER_SUPPRESS			93
+#define WLC_GET_PHYREG				94
+#define WLC_SET_PHYREG				95
+#define WLC_GET_RADIOREG			96
+#define WLC_SET_RADIOREG			97
+#define WLC_GET_REVINFO				98
+#define WLC_GET_UCANTDIV			99
+#define WLC_SET_UCANTDIV			100
+#define WLC_R_REG				101
+#define WLC_W_REG				102
+#define WLC_DIAG_LOOPBACK			103
+#define WLC_RESET_D11CNTS			104
+#define WLC_GET_MACMODE				105
+#define WLC_SET_MACMODE				106
+#define WLC_GET_MONITOR				107
+#define WLC_SET_MONITOR				108
+#define WLC_GET_GMODE				109
+#define WLC_SET_GMODE				110
+#define WLC_GET_LEGACY_ERP			111
+#define WLC_SET_LEGACY_ERP			112
+#define WLC_GET_RX_ANT				113
+#define WLC_GET_CURR_RATESET			114	/* current rateset */
+#define WLC_GET_SCANSUPPRESS			115
+#define WLC_SET_SCANSUPPRESS			116
+#define WLC_GET_AP				117
+#define WLC_SET_AP				118
+#define WLC_GET_EAP_RESTRICT			119
+#define WLC_SET_EAP_RESTRICT			120
+#define WLC_SCB_AUTHORIZE			121
+#define WLC_SCB_DEAUTHORIZE			122
+#define WLC_GET_WDSLIST				123
+#define WLC_SET_WDSLIST				124
+#define WLC_GET_ATIM				125
+#define WLC_SET_ATIM				126
+#define WLC_GET_RSSI				127
+#define WLC_GET_PHYANTDIV			128
+#define WLC_SET_PHYANTDIV			129
+#define WLC_AP_RX_ONLY				130
+#define WLC_GET_TX_PATH_PWR			131
+#define WLC_SET_TX_PATH_PWR			132
+#define WLC_GET_WSEC				133
+#define WLC_SET_WSEC				134
+#define WLC_GET_PHY_NOISE			135
+#define WLC_GET_BSS_INFO			136
+#define WLC_GET_PKTCNTS				137
+#define WLC_GET_LAZYWDS				138
+#define WLC_SET_LAZYWDS				139
+#define WLC_GET_BANDLIST			140
+#define WLC_GET_BAND				141
+#define WLC_SET_BAND				142
+#define WLC_SCB_DEAUTHENTICATE			143
+#define WLC_GET_SHORTSLOT			144
+#define WLC_GET_SHORTSLOT_OVERRIDE		145
+#define WLC_SET_SHORTSLOT_OVERRIDE		146
+#define WLC_GET_SHORTSLOT_RESTRICT		147
+#define WLC_SET_SHORTSLOT_RESTRICT		148
+#define WLC_GET_GMODE_PROTECTION		149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE	150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE	151
+#define WLC_UPGRADE				152
+#define WLC_GET_MRATE				153
+#define WLC_SET_MRATE				154
+#define WLC_GET_IGNORE_BCNS			155
+#define WLC_SET_IGNORE_BCNS			156
+#define WLC_GET_SCB_TIMEOUT			157
+#define WLC_SET_SCB_TIMEOUT			158
+#define WLC_GET_ASSOCLIST			159
+#define WLC_GET_CLK				160
+#define WLC_SET_CLK				161
+#define WLC_GET_UP				162
+#define WLC_OUT					163
+#define WLC_GET_WPA_AUTH			164
+#define WLC_SET_WPA_AUTH			165
+#define WLC_GET_UCFLAGS				166
+#define WLC_SET_UCFLAGS				167
+#define WLC_GET_PWRIDX				168
+#define WLC_SET_PWRIDX				169
+#define WLC_GET_TSSI				170
+#define WLC_GET_SUP_RATESET_OVERRIDE		171
+#define WLC_SET_SUP_RATESET_OVERRIDE		172
+#define WLC_SET_FAST_TIMER			173
+#define WLC_GET_FAST_TIMER			174
+#define WLC_SET_SLOW_TIMER			175
+#define WLC_GET_SLOW_TIMER			176
+#define WLC_DUMP_PHYREGS			177
+#define WLC_GET_GMODE_PROTECTION_CONTROL	178
+#define WLC_SET_GMODE_PROTECTION_CONTROL	179
+#define WLC_GET_PHYLIST				180
+#define WLC_ENCRYPT_STRENGTH			181	/* ndis only */
+#define WLC_DECRYPT_STATUS			182	/* ndis only */
+#define WLC_GET_KEY_SEQ				183
+#define WLC_GET_SCAN_CHANNEL_TIME		184
+#define WLC_SET_SCAN_CHANNEL_TIME		185
+#define WLC_GET_SCAN_UNASSOC_TIME		186
+#define WLC_SET_SCAN_UNASSOC_TIME		187
+#define WLC_GET_SCAN_HOME_TIME			188
+#define WLC_SET_SCAN_HOME_TIME			189
+#define WLC_GET_SCAN_PASSES			190
+#define WLC_SET_SCAN_PASSES			191
+#define WLC_GET_PRB_RESP_TIMEOUT		192
+#define WLC_SET_PRB_RESP_TIMEOUT		193
+#define WLC_GET_ATTEN				194
+#define WLC_SET_ATTEN				195
+#define WLC_GET_SHMEM				196	/* diag */
+#define WLC_SET_SHMEM				197	/* diag */
+#define WLC_GET_GMODE_PROTECTION_CTS		198
+#define WLC_SET_GMODE_PROTECTION_CTS		199
+#define WLC_SET_TKIP_MIC_FLAG			200
+#define WLC_SCB_DEAUTHENTICATE_FOR_REASON	201
+#define WLC_TKIP_COUNTERMEASURES		202
+#define WLC_GET_PIOMODE				203
+#define WLC_SET_PIOMODE				204
+#define WLC_SET_LED				209
+#define WLC_GET_LED				210
+#define WLC_GET_INTERFERENCE_MODE		211
+#define WLC_SET_INTERFERENCE_MODE		212
+#define WLC_GET_CHANNEL_QA			213
+#define WLC_START_CHANNEL_QA			214
+#define WLC_GET_CHANNEL_SEL			215
+#define WLC_START_CHANNEL_SEL			216
+#define WLC_GET_VALID_CHANNELS			217
+#define WLC_GET_FAKEFRAG			218
+#define WLC_SET_FAKEFRAG			219
+#define WLC_GET_PWROUT_PERCENTAGE		220
+#define WLC_SET_PWROUT_PERCENTAGE		221
+#define WLC_SET_BAD_FRAME_PREEMPT		222
+#define WLC_GET_BAD_FRAME_PREEMPT		223
+#define WLC_SET_LEAP_LIST			224
+#define WLC_GET_LEAP_LIST			225
+#define WLC_GET_CWMIN				226
+#define WLC_SET_CWMIN				227
+#define WLC_GET_CWMAX				228
+#define WLC_SET_CWMAX				229
+#define WLC_GET_WET				230
+#define WLC_SET_WET				231
+#define WLC_GET_KEY_PRIMARY			235
+#define WLC_SET_KEY_PRIMARY			236
+#define WLC_SCAN_WITH_CALLBACK			240
+#define WLC_GET_RADAR				242
+#define WLC_SET_RADAR				243
+#define WLC_SET_SPECT_MANAGMENT			244
+#define WLC_GET_SPECT_MANAGMENT			245
+#define WLC_WDS_GET_REMOTE_HWADDR		246	/* currently handled in wl_linux.c/wl_vx.c */
+#define WLC_SET_CS_SCAN_TIMER			248
+#define WLC_GET_CS_SCAN_TIMER			249
+#define WLC_SEND_PWR_CONSTRAINT			254
+#define WLC_CURRENT_PWR				256
+#define WLC_GET_CHANNELS_IN_COUNTRY		260
+#define WLC_GET_COUNTRY_LIST			261
+#define WLC_GET_VAR				262	/* get value of named variable */
+#define WLC_SET_VAR				263	/* set named variable to value */
+#define WLC_NVRAM_GET				264
+#define WLC_NVRAM_SET				265
+#define WLC_SET_WSEC_PMK			268
+#define WLC_GET_AUTH_MODE			269
+#define WLC_SET_AUTH_MODE			270
+#define WLC_NDCONFIG_ITEM			273	/* currently handled in wl_oid.c */
+#define WLC_NVOTPW					274
+/* #define WLC_OTPW					275 */ /* no longer supported */
+#define WLC_SET_LOCALE				278
+#define WLC_LAST				279	/* do not change - use get_var/set_var */
+
+/*
+ * Minor kludge alert:
+ * Duplicate a few definitions that irelay requires from epiioctl.h here
+ * so caller doesn't have to include this file and epiioctl.h .
+ * If this grows any more, it would be time to move these irelay-specific
+ * definitions out of the epiioctl.h and into a separate driver common file.
+ */
+#ifndef EPICTRL_COOKIE
+#define EPICTRL_COOKIE		0xABADCEDE
+#endif
+
+/* vx wlc ioctl's offset */
+#define CMN_IOCTL_OFF 0x180
+
+/*
+ * custom OID support
+ *
+ * 0xFF - implementation specific OID
+ * 0xE4 - first byte of Broadcom PCI vendor ID
+ * 0x14 - second byte of Broadcom PCI vendor ID
+ * 0xXX - the custom OID number
+ */
+
+/* begin 0x1f values beyond the start of the ET driver range. */
+#define WL_OID_BASE		0xFFE41420
+
+/* NDIS overrides */
+#define OID_WL_GETINSTANCE	(WL_OID_BASE + WLC_GET_INSTANCE)
+#define OID_WL_NDCONFIG_ITEM (WL_OID_BASE + WLC_NDCONFIG_ITEM)
+
+#define WL_DECRYPT_STATUS_SUCCESS	1
+#define WL_DECRYPT_STATUS_FAILURE	2
+#define WL_DECRYPT_STATUS_UNKNOWN	3
+
+/* allows user-mode app to poll the status of USB image upgrade */
+#define WLC_UPGRADE_SUCCESS			0
+#define WLC_UPGRADE_PENDING			1
+
+/* Bit masks for radio disabled status - returned by WL_GET_RADIO */
+#define WL_RADIO_SW_DISABLE		(1<<0)
+#define WL_RADIO_HW_DISABLE		(1<<1)
+#define WL_RADIO_MPC_DISABLE		(1<<2)
+#define WL_RADIO_COUNTRY_DISABLE	(1<<3)	/* some countries don't support any 802.11 channel */
+
+/* Override bit for WLC_SET_TXPWR.  if set, ignore other level limits */
+#define WL_TXPWR_OVERRIDE	(1<<31)
+
+/* "diag" iovar argument and error code */
+#define WL_DIAG_INTERRUPT			1	/* d11 loopback interrupt test */
+#define WL_DIAG_MEMORY				3	/* d11 memory test */
+#define WL_DIAG_LED				4	/* LED test */
+#define WL_DIAG_REG				5	/* d11/phy register test */
+#define WL_DIAG_SROM				6	/* srom read/crc test */
+#define WL_DIAG_DMA				7	/* DMA test */
+
+#define WL_DIAGERR_SUCCESS			0
+#define WL_DIAGERR_FAIL_TO_RUN			1	/* unable to run requested diag */
+#define WL_DIAGERR_NOT_SUPPORTED		2	/* diag requested is not supported */
+#define WL_DIAGERR_INTERRUPT_FAIL		3	/* loopback interrupt test failed */
+#define WL_DIAGERR_LOOPBACK_FAIL		4	/* loopback data test failed */
+#define WL_DIAGERR_SROM_FAIL			5	/* srom read failed */
+#define WL_DIAGERR_SROM_BADCRC			6	/* srom crc failed */
+#define WL_DIAGERR_REG_FAIL			7	/* d11/phy register test failed */
+#define WL_DIAGERR_MEMORY_FAIL			8	/* d11 memory test failed */
+#define WL_DIAGERR_NOMEM			9	/* diag test failed due to no memory */
+#define WL_DIAGERR_DMA_FAIL			10	/* DMA test failed */
+
+/* Bus types */
+#define WL_SB_BUS	0	/* Silicon Backplane */
+#define WL_PCI_BUS	1	/* PCI target */
+#define WL_PCMCIA_BUS	2	/* PCMCIA target */
+
+/* band types */
+#define	WLC_BAND_AUTO		0	/* auto-select */
+#define	WLC_BAND_A		1	/* "a" band (5   Ghz) */
+#define	WLC_BAND_B		2	/* "b" band (2.4 Ghz) */
+
+/* phy types (returned by WLC_GET_PHYTPE) */
+#define	WLC_PHY_TYPE_A		0
+#define	WLC_PHY_TYPE_B		1
+#define	WLC_PHY_TYPE_G		2
+#define	WLC_PHY_TYPE_NULL	0xf
+
+/* MAC list modes */
+#define WLC_MACMODE_DISABLED	0	/* MAC list disabled */
+#define WLC_MACMODE_DENY	1	/* Deny specified (i.e. allow unspecified) */
+#define WLC_MACMODE_ALLOW	2	/* Allow specified (i.e. deny unspecified) */	
+
+
+/* 54g modes (basic bits may still be overridden) */
+#define GMODE_LEGACY_B		0	/* Rateset: 1b, 2b, 5.5, 11 */
+					/* Preamble: Long */
+					/* Shortslot: Off */
+#define GMODE_AUTO		1	/* Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54 */
+					/* Extended Rateset: 6, 9, 12, 48 */
+					/* Preamble: Long */
+					/* Shortslot: Auto */
+#define GMODE_ONLY		2	/* Rateset: 1b, 2b, 5.5b, 11b, 18, 24b, 36, 54 */
+					/* Extended Rateset: 6b, 9, 12b, 48 */
+					/* Preamble: Short required */
+					/* Shortslot: Auto */
+#define GMODE_B_DEFERRED	3	/* Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54 */
+					/* Extended Rateset: 6, 9, 12, 48 */
+					/* Preamble: Long */
+					/* Shortslot: On */
+#define GMODE_PERFORMANCE	4	/* Rateset: 1b, 2b, 5.5b, 6b, 9, 11b, 12b, 18, 24b, 36, 48, 54 */
+					/* Preamble: Short required */
+					/* Shortslot: On and required */
+#define GMODE_LRS		5	/* Rateset: 1b, 2b, 5.5b, 11b */
+					/* Extended Rateset: 6, 9, 12, 18, 24, 36, 48, 54 */
+					/* Preamble: Long */
+					/* Shortslot: Auto */
+#define GMODE_MAX		6
+
+
+/* values for PLCPHdr_override */
+#define WLC_PLCP_AUTO	-1
+#define WLC_PLCP_SHORT	0
+#define WLC_PLCP_LONG	1
+
+/* values for g_protection_override */
+#define WLC_G_PROTECTION_AUTO	-1
+#define WLC_G_PROTECTION_OFF	0
+#define WLC_G_PROTECTION_ON	1
+
+/* values for g_protection_control */
+#define WLC_G_PROTECTION_CTL_OFF	0
+#define WLC_G_PROTECTION_CTL_LOCAL	1
+#define WLC_G_PROTECTION_CTL_OVERLAP	2
+
+/* Values for PM */
+#define PM_OFF	0
+#define PM_MAX	1
+#define PM_FAST 2
+
+/* interference mitigation options */
+#define	INTERFERE_NONE	0	/* off */
+#define	NON_WLAN        1	/* foreign/non 802.11 interference, no auto detect */
+#define	WLAN_MANUAL     2	/* ACI: no auto detection */
+#define	WLAN_AUTO       3	/* ACI: auto - detact */
+
+/* Message levels */
+#define WL_ERROR_VAL		0x0001
+#define WL_TRACE_VAL		0x0002
+#define WL_PRHDRS_VAL		0x0004
+#define WL_PRPKT_VAL		0x0008
+#define WL_INFORM_VAL		0x0010
+#define WL_TMP_VAL		0x0020
+#define WL_OID_VAL		0x0040
+#define WL_RATE_VAL		0x0080
+#define WL_ASSOC_VAL		0x0100
+#define WL_PRUSR_VAL		0x0200
+#define WL_PS_VAL		0x0400
+#define WL_TXPWR_VAL		0x0800
+#define WL_GMODE_VAL		0x1000
+#define WL_DUAL_VAL		0x2000
+#define WL_WSEC_VAL		0x4000
+#define WL_WSEC_DUMP_VAL	0x8000
+#define WL_LOG_VAL		0x10000
+#define WL_NRSSI_VAL		0x20000
+#define WL_LOFT_VAL		0x40000
+#define WL_REGULATORY_VAL	0x80000
+#define WL_ACI_VAL		0x100000
+
+
+/* 802.11h enforcement levels */
+#define SPECT_MNGMT_OFF         0   /* 11h disabled */
+#define SPECT_MNGMT_LOOSE       1   /* Allow scan lists to contain non-11h AP */
+				    /* when 11h is enabled */
+#define SPECT_MNGMT_STRICT      2   /* Prine out non-11h APs from scan list */
+
+typedef struct {
+	int npulses; 	/* required number of pulses at n * t_int */
+	int ncontig; 	/* required number of pulses at t_int */
+	int min_pw; 	/* minimum pulse width (20 MHz clocks) */
+	int max_pw; 	/* maximum pulse width (20 MHz clocks) */	
+	uint16 thresh0;	/* Radar detection, thresh 0 */
+	uint16 thresh1;	/* Radar detection, thresh 1 */
+} wl_radar_args_t;
+
+/* radar iovar SET defines */
+#define WL_RADRA_DETECTOR_OFF		0	/* radar dector off */
+#define WL_RADAR_DETECTOR_ON		1	/* radar detector on */
+#define WL_RADAR_SIMULATED		2	/* force radar detector to declare detection once */
+
+/* dfs_status iovar-related defines */
+
+/* cac - channel availability check,
+ * ism - in-service monitoring
+ * csa - channel switching anouncement
+ */
+
+/* cac state values */
+#define WL_DFS_CACSTATE_IDLE		0	/* state for operating in non-radar channel */
+#define	WL_DFS_CACSTATE_PREISM_CAC	1	/* CAC in progress */
+#define WL_DFS_CACSTATE_ISM		2	/* ISM in progress */
+#define WL_DFS_CACSTATE_CSA		3	/* csa */
+#define WL_DFS_CACSTATE_POSTISM_CAC	4	/* ISM CAC */
+#define WL_DFS_CACSTATE_PREISM_OOC	5	/* PREISM OOC */
+#define WL_DFS_CACSTATE_POSTISM_OOC	6	/* POSTISM OOC */
+#define WL_DFS_CACSTATES		7	/* this many states exist */
+
+/* data structure used in 'dfs_status' wl interface, which is used to query dfs status */
+typedef struct {
+	uint state;		/* noted by WL_DFS_CACSTATE_XX. */
+	uint duration;		/* time spent in ms in state. */
+	/* as dfs enters ISM state, it removes the operational channel from quiet channel list
+	 * and notes the channel in channel_cleared. set to 0 if no channel is cleared
+	 */
+	uint channel_cleared;
+} wl_dfs_status_t;
+
+#define NUM_PWRCTRL_RATES 12
+ 
+ 
+/* 802.11h enforcement levels */
+#define SPECT_MNGMT_OFF		0		/* 11h disabled */
+#define SPECT_MNGMT_LOOSE	1		/* allow scan lists to contain non-11h AP */
+#define SPECT_MNGMT_STRICT	2		/* prune out non-11h APs from scan list */
+#define SPECT_MNGMT_11D		3		/* switch to 802.11D mode */
+
+#define WL_CHAN_VALID_HW	(1 << 0)	/* valid with current HW */
+#define WL_CHAN_VALID_SW	(1 << 1)	/* valid with current country setting */
+#define WL_CHAN_BAND_A		(1 << 2)	/* A-band channel */
+#define WL_CHAN_RADAR		(1 << 3)	/* radar sensitive  channel */
+#define WL_CHAN_INACTIVE	(1 << 4)	/* temporarily out of service due to radar */
+#define WL_CHAN_RADAR_PASSIVE	(1 << 5)	/* radar channel is in passive mode */
+
+#define WL_MPC_VAL		0x00400000
+#define WL_APSTA_VAL		0x00800000
+#define WL_DFS_VAL		0x01000000
+
+
+/* max # of leds supported by GPIO (gpio pin# == led index#) */
+#define	WL_LED_NUMGPIO		16	/* gpio 0-15 */
+
+/* led per-pin behaviors */
+#define	WL_LED_OFF		0		/* always off */
+#define	WL_LED_ON		1		/* always on */
+#define	WL_LED_ACTIVITY		2		/* activity */
+#define	WL_LED_RADIO		3		/* radio enabled */
+#define	WL_LED_ARADIO		4		/* 5  Ghz radio enabled */
+#define	WL_LED_BRADIO		5		/* 2.4Ghz radio enabled */
+#define	WL_LED_BGMODE		6		/* on if gmode, off if bmode */
+#define	WL_LED_WI1		7		
+#define	WL_LED_WI2		8		
+#define	WL_LED_WI3		9		
+#define	WL_LED_ASSOC		10		/* associated state indicator */
+#define	WL_LED_INACTIVE		11		/* null behavior (clears default behavior) */
+#define	WL_LED_NUMBEHAVIOR	12
+
+/* led behavior numeric value format */
+#define	WL_LED_BEH_MASK		0x7f		/* behavior mask */
+#define	WL_LED_AL_MASK		0x80		/* activelow (polarity) bit */
+
+
+/* maximum channels */
+#define WL_NUMCHANNELS	64	/* max # of channels in the band */
+
+/* rate check */
+#define WL_RATE_OFDM(r)		(((r) & 0x7f) == 12 || ((r) & 0x7f) == 18 || \
+				 ((r) & 0x7f) == 24 || ((r) & 0x7f) == 36 || \
+				 ((r) & 0x7f) == 48 || ((r) & 0x7f) == 72 || \
+				 ((r) & 0x7f) == 96 || ((r) & 0x7f) == 108)
+
+/* WDS link local endpoint WPA role */
+#define WL_WDS_WPA_ROLE_AUTH	0	/* authenticator */
+#define WL_WDS_WPA_ROLE_SUP	1	/* supplicant */
+#define WL_WDS_WPA_ROLE_AUTO	255	/* auto, based on mac addr value */
+
+/* afterburner_override */
+#define	ABO_AUTO		-1	/* auto - no override */
+#define	ABO_OFF			0	/* force afterburner off */
+#define	ABO_ON			1	/* force afterburner on */
+
+#define GMODE_AFTERBURNER 6
+
+/* number of bytes needed to define a 128-bit mask for MAC event reporting */
+#define WL_EVENTING_MASK_LEN	16
+
+/* Structures and constants used for "vndr_ie" IOVar interface */
+#define VNDR_IE_CMD_LEN		4	/* length of the set command string: "add", "del" (+ NULL) */
+
+/* 802.11 Mgmt Packet flags */
+#define VNDR_IE_BEACON_FLAG	0x1
+#define VNDR_IE_PRBRSP_FLAG	0x2
+#define VNDR_IE_ASSOCRSP_FLAG	0x4
+#define VNDR_IE_AUTHRSP_FLAG	0x8
+
+typedef struct {
+	uint32 pktflag;			/* bitmask indicating which packet(s) contain this IE */
+	vndr_ie_t vndr_ie_data;		/* vendor IE data */
+} vndr_ie_info_t;
+
+typedef struct {
+	int iecount;			/* number of entries in the vndr_ie_list[] array */
+	vndr_ie_info_t vndr_ie_list[1];	/* variable size list of vndr_ie_info_t structs */
+} vndr_ie_buf_t;
+
+typedef struct {
+	char cmd[VNDR_IE_CMD_LEN];	/* vndr_ie IOVar set command : "add", "del" + NULL */
+	vndr_ie_buf_t vndr_ie_buffer;	/* buffer containing Vendor IE list information */
+} vndr_ie_setbuf_t;
+
+/* join target preference types */
+#define WL_JOIN_PREF_RSSI	1	/* by RSSI, mandatory */
+#define WL_JOIN_PREF_WPA	2	/* by akm and ciphers, optional, RSN and WPA as values */
+#define WL_JOIN_PREF_BAND	3	/* by 802.11 band, optional, WLC_BAND_XXXX as values */
+
+/* band preference */
+#define WLJP_BAND_ASSOC_PREF	255	/* use assoc preference settings */
+					/* others use WLC_BAND_XXXX as values */
+
+/* any multicast cipher suite */
+#define WL_WPA_ACP_MCS_ANY	"\x00\x00\x00\x00"
+
+#if !defined(__GNUC__)
+#pragma pack(pop)
+#endif
+
+#define	NFIFO				6	/* # tx/rx fifopairs */
+
+#define	WL_CNT_T_VERSION		1	/* current version of wl_cnt_t struct */
+
+typedef struct {
+	uint16	version;	/* see definition of WL_CNT_T_VERSION */	
+	uint16	length;		/* length of entire structure */
+
+ 	/* transmit stat counters */
+	uint32	txframe;	/* tx data frames */
+	uint32	txbyte;		/* tx data bytes */
+	uint32	txretrans;	/* tx mac retransmits */
+	uint32	txerror;	/* tx data errors */
+	uint32	txctl;		/* tx management frames */
+	uint32	txprshort;	/* tx short preamble frames */
+	uint32	txserr;		/* tx status errors */
+	uint32	txnobuf;	/* tx out of buffers errors */
+	uint32	txnoassoc;	/* tx discard because we're not associated */
+	uint32	txrunt;		/* tx runt frames */
+	uint32	txchit;		/* tx header cache hit (fastpath) */
+	uint32	txcmiss;	/* tx header cache miss (slowpath) */
+
+	/* transmit chip error counters */
+	uint32	txuflo;		/* tx fifo underflows */
+	uint32	txphyerr;	/* tx phy errors (indicated in tx status) */
+	uint32	txphycrs;	
+
+	/* receive stat counters */
+	uint32	rxframe;	/* rx data frames */
+	uint32	rxbyte;		/* rx data bytes */
+	uint32	rxerror;	/* rx data errors */
+	uint32	rxctl;		/* rx management frames */
+	uint32	rxnobuf;	/* rx out of buffers errors */
+	uint32	rxnondata;	/* rx non data frames in the data channel errors */
+	uint32	rxbadds;	/* rx bad DS errors */
+	uint32	rxbadcm;	/* rx bad control or management frames */
+	uint32	rxfragerr;	/* rx fragmentation errors */
+	uint32	rxrunt;		/* rx runt frames */
+	uint32	rxgiant;	/* rx giant frames */
+	uint32	rxnoscb;	/* rx no scb error */
+	uint32	rxbadproto;	/* rx invalid frames */
+	uint32	rxbadsrcmac;	/* rx frames with Invalid Src Mac*/
+	uint32	rxbadda;	/* rx frames tossed for invalid da */
+	uint32	rxfilter;	/* rx frames filtered out */
+
+	/* receive chip error counters */
+	uint32	rxoflo;		/* rx fifo overflow errors */
+	uint32	rxuflo[NFIFO];	/* rx dma descriptor underflow errors */
+
+	uint32	d11cnt_txrts_off;	/* d11cnt txrts value when reset d11cnt */
+	uint32	d11cnt_rxcrc_off;	/* d11cnt rxcrc value when reset d11cnt */
+	uint32	d11cnt_txnocts_off;	/* d11cnt txnocts value when reset d11cnt */
+
+	/* misc counters */
+	uint32	dmade;		/* tx/rx dma descriptor errors */
+	uint32	dmada;		/* tx/rx dma data errors */
+	uint32	dmape;		/* tx/rx dma descriptor protocol errors */
+	uint32	reset;		/* reset count */
+	uint32	tbtt;		/* cnts the TBTT int's */
+	uint32	txdmawar;	
+
+	/* MAC counters: 32-bit version of d11.h's macstat_t */
+	uint32	txallfrm;	/* total number of frames sent, incl. Data, ACK, RTS, CTS, 
+				   Control Management (includes retransmissions) */
+	uint32	txrtsfrm;	/* number of RTS sent out by the MAC */
+	uint32	txctsfrm;	/* number of CTS sent out by the MAC */
+	uint32	txackfrm;	/* number of ACK frames sent out */
+	uint32	txdnlfrm;	/* Not used */
+	uint32	txbcnfrm;	/* beacons transmitted */
+	uint32	txfunfl[8];	/* per-fifo tx underflows */
+	uint32	txtplunfl;	/* Template underflows (mac was too slow to transmit ACK/CTS or BCN) */
+	uint32	txphyerror;	/* Transmit phy error, type of error is reported in tx-status for
+				   driver enqueued frames*/
+	uint32	rxfrmtoolong;	/* Received frame longer than legal limit (2346 bytes) */
+	uint32	rxfrmtooshrt;	/* Received frame did not contain enough bytes for its frame type */
+	uint32	rxinvmachdr;	/* Either the protocol version != 0 or frame type not
+				   data/control/management*/
+	uint32	rxbadfcs;	/* number of frames for which the CRC check failed in the MAC */
+	uint32	rxbadplcp;	/* parity check of the PLCP header failed */
+	uint32	rxcrsglitch;	/* PHY was able to correlate the preamble but not the header */
+	uint32	rxstrt;		/* Number of received frames with a good PLCP (i.e. passing parity check) */
+	uint32	rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+	uint32	rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+	uint32	rxcfrmucast;	/* number of received CNTRL frames with good FCS and matching RA */
+	uint32	rxrtsucast;	/* number of unicast RTS addressed to the MAC (good FCS) */
+	uint32	rxctsucast;	/* number of unicast CTS addressed to the MAC (good FCS)*/
+	uint32	rxackucast;	/* number of ucast ACKS received (good FCS)*/
+	uint32	rxdfrmocast;	/* number of received DATA frames with good FCS and not matching RA */
+	uint32	rxmfrmocast;	/* number of received MGMT frames with good FCS and not matching RA */
+	uint32	rxcfrmocast;	/* number of received CNTRL frame with good FCS and not matching RA */
+	uint32	rxrtsocast;	/* number of received RTS not addressed to the MAC */
+	uint32	rxctsocast;	/* number of received CTS not addressed to the MAC */
+	uint32	rxdfrmmcast;	/* number of RX Data multicast frames received by the MAC */
+	uint32	rxmfrmmcast;	/* number of RX Management multicast frames received by the MAC */
+	uint32	rxcfrmmcast;	/* number of RX Control multicast frames received by the MAC (unlikely
+				   to see these) */
+	uint32	rxbeaconmbss;	/* beacons received from member of BSS */
+	uint32	rxdfrmucastobss; /* number of unicast frames addressed to the MAC from other BSS (WDS FRAME) */
+	uint32	rxbeaconobss;	/* beacons received from other BSS */
+	uint32	rxrsptmout;	/* Number of response timeouts for transmitted frames expecting a
+				   response */
+	uint32	bcntxcancl;	/* transmit beacons cancelled due to receipt of beacon (IBSS) */
+	uint32	rxf0ovfl;	/* Number of receive fifo 0 overflows */
+	uint32	rxf1ovfl;	/* Number of receive fifo 1 overflows (obsolete) */
+	uint32	rxf2ovfl;	/* Number of receive fifo 2 overflows (obsolete) */
+	uint32	txsfovfl;	/* Number of transmit status fifo overflows (obsolete) */
+	uint32	pmqovfl;	/* Number of PMQ overflows */
+	uint32	rxcgprqfrm;	/* Number of received Probe requests that made it into the PRQ fifo */
+	uint32	rxcgprsqovfl;	/* Rx Probe Request Que overflow in the AP */
+	uint32	txcgprsfail;	/* Tx Probe Response Fail. AP sent probe response but did not get ACK */
+	uint32	txcgprssuc;	/* Tx Probe Rresponse Success (ACK was received) */
+	uint32	prs_timeout;	/* Number of probe requests that were dropped from the PRQ fifo because
+				   a probe response could not be sent out within the time limit defined
+				   in M_PRS_MAXTIME */
+	uint32	rxnack;		/* Number of NACKS received (Afterburner) */
+	uint32	frmscons;	/* Number of frames completed without transmission because of an
+				   Afterburner re-queue */
+	uint32	txnack;		/* Number of NACKs transmtitted  (Afterburner) */
+	uint32	txglitch_nack;	/* obsolete */
+	uint32	txburst;	/* obsolete */
+	uint32	rxburst;	/* obsolete */
+
+	/* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+	uint32	txfrag;		/* dot11TransmittedFragmentCount */
+	uint32	txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32	txfail;		/* dot11FailedCount */
+	uint32	txretry;	/* dot11RetryCount */
+	uint32	txretrie;	/* dot11MultipleRetryCount */
+	uint32	rxdup;		/* dot11FrameduplicateCount */
+	uint32	txrts;		/* dot11RTSSuccessCount */
+	uint32	txnocts;	/* dot11RTSFailureCount */
+	uint32	txnoack;	/* dot11ACKFailureCount */
+	uint32	rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32	rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32	rxcrc;		/* dot11FCSErrorCount */
+	uint32	txfrmsnt;	/* dot11TransmittedFrameCount (bogus MIB?) */
+	uint32	rxundec;	/* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32	tkipmicfaill;	/* TKIPLocalMICFailures */
+	uint32	tkipcntrmsr;	/* TKIPCounterMeasuresInvoked */
+	uint32	tkipreplay;	/* TKIPReplays */
+	uint32	ccmpfmterr;	/* CCMPFormatErrors */
+	uint32	ccmpreplay;	/* CCMPReplays */
+	uint32	ccmpundec;	/* CCMPDecryptErrors */
+	uint32	fourwayfail;	/* FourWayHandshakeFailures */
+	uint32	wepundec;	/* dot11WEPUndecryptableCount */
+	uint32	wepicverr;	/* dot11WEPICVErrorCount */
+	uint32	decsuccess;	/* DecryptSuccessCount */
+	uint32	tkipicverr;	/* TKIPICVErrorCount */
+	uint32	wepexcluded;	/* dot11WEPExcludedCount */
+} wl_cnt_t;
+
+#endif /* _wlioctl_h_ */
diff --git a/openwrt/package/wificonf/wificonf.c b/openwrt/package/wificonf/wificonf.c
index 1ca1e5eb58..a5062c585d 100644
--- a/openwrt/package/wificonf/wificonf.c
+++ b/openwrt/package/wificonf/wificonf.c
@@ -1,7 +1,7 @@
 /*
  * Wireless Network Adapter configuration utility
  *
- * Copyright (C) 2005 Felix Fietkau <nbd@vd-s.ath.cx>
+ * Copyright (C) 2005 Felix Fietkau <nbd@openwrt.org>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -22,6 +22,9 @@
 #include <wlioctl.h>
 #include <signal.h>
 
+#define	ADD_VIF_RETRIES	5
+#define DEBUG
+
 /*------------------------------------------------------------------*/
 /*
  * Macro to handle errors when setting WE
@@ -85,8 +88,17 @@ static int wpa_enc = 0;
 
 static char *wl_var(char *name)
 {
-	strcpy(buffer, prefix);
-	strcat(buffer, name);
+	sprintf(buffer, "%s_%s", prefix, name);
+	return buffer;
+}
+
+static char *vif_var(int vif, char *name)
+{
+	if (vif == 0)
+		return wl_var(name);
+	
+	sprintf(buffer, "%s.%d_%s", prefix, vif, name);
+	return buffer;
 }
 
 static int nvram_enabled(char *name)
@@ -114,11 +126,16 @@ static int bcom_ioctl(int skfd, char *ifname, int cmd, void *buf, int len)
 	strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
 
 	ret = ioctl(skfd, SIOCDEVPRIVATE, &ifr);
+	
+#ifdef DEBUG
+	if (ret < 0)
+		fprintf(stderr, "IOCTL %d failed: %d\n", cmd, ret);
+#endif
 
 	return ret;
 }
 
-static int bcom_set_val(int skfd, char *ifname, char *var, void *val, int len)
+static int bcom_set_var(int skfd, char *ifname, char *var, void *val, int len)
 {
 	char buf[8192];
 	int ret;
@@ -126,18 +143,128 @@ static int bcom_set_val(int skfd, char *ifname, char *var, void *val, int len)
 	if (strlen(var) + 1 > sizeof(buf) || len > sizeof(buf))
 		return -1;
 
+	bzero(buf, sizeof(buf));
 	strcpy(buf, var);
 	memcpy(&buf[strlen(var) + 1], val, len);
 	
-	if ((ret = bcom_ioctl(skfd, ifname, WLC_SET_VAR, buf, sizeof(buf))))
-		return ret;
+	ret = bcom_ioctl(skfd, ifname, WLC_SET_VAR, buf, sizeof(buf));
+
+#ifdef DEBUG
+	if (ret < 0)
+		fprintf(stderr, "SET_VAR %s failed: %d\n", var, ret);
+#endif
+	
+	return ret;
+}
+
+static int bcom_get_var(int skfd, char *ifname, char *var, void *buf, int len)
+{
+	int ret;
+	
+	if (strlen(var) + 1 > sizeof(buf) || len > sizeof(buf))
+		return -1;
+
+	bzero(buf, sizeof(buf));
+	strcpy(buf, var);
+	
+	ret = bcom_ioctl(skfd, ifname, WLC_GET_VAR, buf, sizeof(buf));
 
-	return 0;	
+#ifdef DEBUG
+	if (ret < 0)
+		fprintf(stderr, "GET_VAR %s failed: %d\n", var, ret);
+#endif
+	
+	return ret;
+}
+
+static int bcom_set_bss_var(int skfd, char *ifname, int bss, char *var, void *val, int len)
+{
+	char buf[8192];
+	int i = 0, ret;
+
+	bzero(buf, sizeof(buf));
+	if (strlen(var) + len + 8 > sizeof(buf) || len > sizeof(buf))
+		return -1;
+	
+	// "bsscfg:<name>\x00" <bss> <data>
+	i = sprintf(buf, "bsscfg:%s", var);
+	buf[i++] = 0;
+			
+	memcpy(buf + i, &bss, sizeof(bss));
+	i += sizeof(bss);
+	
+	memcpy(buf + i, val, len);
+	i += len;
+	
+	ret = bcom_ioctl(skfd, ifname, WLC_SET_VAR, buf, i);
+
+#ifdef DEBUG
+	if (ret < 0)
+		fprintf(stderr, "SET_BSS_VAR %s failed: %d\n", var, ret);
+#endif
+
+	return ret;
 }
 
 static int bcom_set_int(int skfd, char *ifname, char *var, int val)
 {
-	return bcom_set_val(skfd, ifname, var, &val, sizeof(val));
+	return bcom_set_var(skfd, ifname, var, &val, sizeof(val));
+}
+
+static int bcom_set_bss_int(int skfd, char *ifname, int bss, char *var, int val)
+{
+	return bcom_set_bss_var(skfd, ifname, bss, var, &val, sizeof(val));
+}
+
+static int is_new_bcom(int skfd, char *ifname)
+{
+	char buf[8192];
+	
+	bzero(buf, 8192);
+	bcom_ioctl(skfd, ifname, WLC_DUMP, buf, 8192);
+
+	if (strstr(buf, "3.130"))
+		return 1;
+
+	return 0;
+}
+
+static int bcom_get_wsec(int vif)
+{
+	int val; 
+
+	if (nvram_match(vif_var(vif, "crypto"), "tkip"))
+		val = TKIP_ENABLED;
+	else if (nvram_match(vif_var(vif, "crypto"), "aes"))
+		val = AES_ENABLED;
+	else if (nvram_match(vif_var(vif, "crypto"), "tkip+aes") || nvram_match(vif_var(vif, "crypto"), "aes+tkip"))
+		val = TKIP_ENABLED | AES_ENABLED;
+	else
+		val = 0;
+	
+	return val;
+}
+
+static int bcom_get_wauth(int vif)
+{
+	char *v, *next, var[80];
+	int res = 0;
+	
+	if (!(v = nvram_get(vif_var(vif, "akm"))))
+		v = nvram_safe_get(vif_var(vif, "auth_mode"));
+
+	foreach(var, v, next) {
+		if (strcmp(var, "psk") == 0)
+			res |= WPA_AUTH_PSK;
+		else if (strcmp(var, "psk2") == 0)
+			res |= WPA2_AUTH_PSK;
+		else if (strcmp(var, "wpa") == 0)
+			res |= WPA_AUTH_UNSPECIFIED;
+		else if (strcmp(var, "wpa2") == 0)
+			res |= WPA2_AUTH_UNSPECIFIED;
+	}
+
+	return res;
 }
 
 static void stop_bcom(int skfd, char *ifname)
@@ -163,7 +290,6 @@ static void start_bcom(int skfd, char *ifname)
 		return;
 
 	bcom_ioctl(skfd, ifname, WLC_UP, &val, sizeof(val));
-	set_wext_ssid(skfd, ifname);
 }
 
 static int setup_bcom_wds(int skfd, char *ifname)
@@ -191,10 +317,26 @@ static int setup_bcom_wds(int skfd, char *ifname)
 	return wds_enabled;
 }
 
+static void set_wext_mode(skfd, ifname)
+{
+	struct iwreq wrq;
+	int ap = 0, infra = 0, wet = 0;
+	
+	/* Set operation mode */
+	ap = !nvram_match(wl_var("mode"), "sta") && !nvram_match(wl_var("mode"), "wet");
+	infra = !nvram_disabled(wl_var("infra"));
+	wet = !ap && nvram_match(wl_var("mode"), "wet");
+
+	wrq.u.mode = (!infra ? IW_MODE_ADHOC : (ap ? IW_MODE_MASTER : (wet ? IW_MODE_REPEAT : IW_MODE_INFRA)));
+	IW_SET_EXT_ERR(skfd, ifname, SIOCSIWMODE, &wrq, "Set Mode");
+}
+
+
 void start_watchdog(int skfd, char *ifname)
 {
 	FILE *f;
-	unsigned char buf[8192], buf2[8192], wbuf[80], *v, *p, *next, *tmp;
+	char *v, *next;
+	unsigned char buf[8192], buf2[8192], wbuf[80], *p, *tmp;
 	int wds = 0, i, restart_wds;
 
 	if (fork())
@@ -242,20 +384,139 @@ void start_watchdog(int skfd, char *ifname)
 	}
 }
 
-static void setup_bcom(int skfd, char *ifname)
+static void setup_bcom_vif_sec(int skfd, char *ifname, int vif)
 {
-	int val = 0, ap;
-	char buf[8192];
-	char wbuf[80];
+	int val, wep, wsec, i;
 	char *v;
-	int wds_enabled = 0;
+
+	wsec = bcom_get_wsec(vif);
+	if (wsec)
+		val = bcom_get_wauth(vif);
+	else
+		val = 0;
+
+	bcom_set_bss_int(skfd, ifname, vif, "wpa_auth", val);
+
+	if (val) {
+		if (WPA_AUTH_PSK | WPA2_AUTH_PSK) {
+			v = nvram_safe_get(wl_var("wpa_psk"));
+			if ((strlen(v) >= 8) && (strlen(v) < 63) && nvram_match(wl_var("mode"), "wet") && (vif == 0)) {
+				/* Enable in-driver WPA supplicant */
+				wsec_pmk_t pmk;
+			
+				pmk.key_len = (unsigned short) strlen(v);
+				pmk.flags = WSEC_PASSPHRASE;
+				strcpy(pmk.key, v);
+				bcom_ioctl(skfd, ifname, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+				bcom_set_int(skfd, ifname, "sup_wpa", 1);
+			} else {
+				bcom_set_int(skfd, ifname, "sup_wpa", 0);
+			}
+		}
+		bcom_set_bss_int(skfd, ifname, vif, "eap_restrict", 1);
+		bcom_set_bss_int(skfd, ifname, vif, "wsec", wsec);
+		bcom_set_bss_int(skfd, ifname, vif, "wsec_restrict", 1);
+	} else {
+		bcom_set_bss_int(skfd, ifname, vif, "eap_restrict", 0);
+		if (wep = nvram_enabled(vif_var(vif, "wep"))) {
+			wep = atoi(nvram_safe_get(vif_var(vif, "key")));
+			if ((wep >= 1) && (wep <= 4)) {
+				for (i = 1; i < 4; i++) {
+					wl_wsec_key_t k;
+					char name[5] = "key0";
+					unsigned char *kdata = k.data;
+					unsigned char *kstr;
+
+					bzero(&k, sizeof(k));
+					name[3] += i;
+					kstr = nvram_safe_get(vif_var(vif, name));
+					k.len = strlen(kstr);
+					if ((k.len == 10) || (k.len == 26)) {
+						k.index = i - 1;
+#ifdef DEBUG
+						fprintf(stderr, "Adding WEP key %d to VIF %d: ", i, vif);
+#endif
+						k.len = 0;
+						while (*kstr != 0) {
+							strncpy(name, kstr, 2);
+							name[2] = 0;
+							*kdata = (unsigned char) strtoul(name, NULL, 16);
+#ifdef DEBUG
+							fprintf(stderr, "%02x", *kdata);
+#endif
+							kstr += 2;
+							kdata++;
+							k.len++;
+						}
+#ifdef DEBUG
+						fprintf(stderr, "\n");
+#endif
+					} else {
+						k.len = 0;
+					}
+					if ((k.len > 0) && (i == wep))
+						k.flags = WL_PRIMARY_KEY;
+
+					bcom_set_bss_var(skfd, ifname, vif, "wsec_key", &k, sizeof(k));
+				}
+				wep = 1;
+				bcom_set_bss_int(skfd, ifname, vif, "wsec", WEP_ENABLED);
+				bcom_set_bss_int(skfd, ifname, vif, "wsec_restrict", 1);
+				bcom_set_bss_int(skfd, ifname, vif, "auth", 1);
+			} else {
+				wep = 0;
+			}
+		}
+	}
 	
-	if (bcom_ioctl(skfd, ifname, WLC_GET_MAGIC, &val, sizeof(val)) < 0)
-		return;
+	if (!wep && !val) {
+		bcom_set_bss_int(skfd, ifname, vif, "wsec", 0);
+		bcom_set_bss_int(skfd, ifname, vif, "wsec_restrict", 0);
+	}
 	
-	nvram_set(wl_var("ifname"), ifname);
+//	bcom_set_bss_int(skfd, ifname, vif, "auth", atoi(nvram_safe_get(vif_var(vif, "auth"))));
+}
+
+static void setup_bcom_vif(int skfd, char *ifname, int vif)
+{
+	int val, wep, wsec, i;
+	char *s, *v;
+	wlc_ssid_t ssid;
+	
+	s = nvram_safe_get(vif_var(vif, "ssid"));
+	strncpy(ssid.SSID, s, sizeof(ssid.SSID));
+	ssid.SSID_len = strlen(ssid.SSID);
+	ssid.SSID_len = ((ssid.SSID_len > sizeof(ssid.SSID)) ? sizeof(ssid.SSID) : ssid.SSID_len);
+	bcom_set_bss_var(skfd, ifname, vif, "ssid", &ssid, sizeof(ssid));
 	
-	stop_bcom(skfd, ifname);
+	val = nvram_enabled(vif_var(vif, "closed"));
+	bcom_set_bss_int(skfd, ifname, vif, "closednet", val);
+
+	val = nvram_enabled(wl_var("ap_isolate"));
+	bcom_set_bss_int(skfd, ifname, vif, "ap_isolate", val);
+
+}
+	
+static void start_bcom_vif(int skfd, char *ifname, int vif)
+{
+	int cfg[2];
+	int i;
+	
+	cfg[0] = vif;
+	cfg[1] = 1;
+	for (i = 0; i < ADD_VIF_RETRIES; i++) {
+		if (bcom_set_var(skfd, ifname, "bss" , cfg, sizeof(cfg)) == 0)
+			break;
+		usleep(1000 * 1000);
+	}
+}
+
+static void setup_bcom_common(int skfd, char *ifname)
+{
+	int val = 0, ap;
+	char buf[8192], wbuf[80], *v;
+
+	nvram_set(wl_var("ifname"), ifname);
 
 	/* Set Country */
 	strncpy(buf, nvram_safe_get(wl_var("country_code")), 4);
@@ -264,13 +525,8 @@ static void setup_bcom(int skfd, char *ifname)
 	
 	/* Set other options */
 	val = nvram_enabled(wl_var("lazywds"));
-	wds_enabled = val;
 	bcom_ioctl(skfd, ifname, WLC_SET_LAZYWDS, &val, sizeof(val));
-	
-	if (v = nvram_get(wl_var("frag"))) {
-		val = atoi(v);
-		bcom_ioctl(skfd, ifname, WLC_SET_FRAG, &val, sizeof(val));
-	}
+
 	if (v = nvram_get(wl_var("dtim"))) {
 		val = atoi(v);
 		bcom_ioctl(skfd, ifname, WLC_SET_DTIMPRD, &val, sizeof(val));
@@ -279,10 +535,6 @@ static void setup_bcom(int skfd, char *ifname)
 		val = atoi(v);
 		bcom_ioctl(skfd, ifname, WLC_SET_BCNPRD, &val, sizeof(val));
 	}
-	if (v = nvram_get(wl_var("rts"))) {
-		val = atoi(v);
-		bcom_ioctl(skfd, ifname, WLC_SET_RTS, &val, sizeof(val));
-	}
 	if (v = nvram_get(wl_var("antdiv"))) {
 		val = atoi(v);
 		bcom_ioctl(skfd, ifname, WLC_SET_ANTDIV, &val, sizeof(val));
@@ -291,16 +543,35 @@ static void setup_bcom(int skfd, char *ifname)
 		val = atoi(v);
 		bcom_ioctl(skfd, ifname, WLC_SET_TXANT, &val, sizeof(val));
 	}
+	if (v = nvram_get(wl_var("maxassoc"))) {
+		val = atoi(v);
+		bcom_set_int(skfd, ifname, "maxassoc", val);
+	}
 	
-	val = nvram_enabled(wl_var("closed"));
-	bcom_ioctl(skfd, ifname, WLC_SET_CLOSED, &val, sizeof(val));
-
-	val = nvram_enabled(wl_var("ap_isolate"));
-	bcom_set_int(skfd, ifname, "ap_isolate", val);
-
 	val = nvram_enabled(wl_var("frameburst"));
 	bcom_ioctl(skfd, ifname, WLC_SET_FAKEFRAG, &val, sizeof(val));
 
+	ap = !nvram_match(wl_var("mode"), "sta") && !nvram_match(wl_var("mode"), "wet");
+
+	if (ap)
+		val = setup_bcom_wds(skfd, ifname);
+
+	if ((!ap || val) && is_new_bcom(skfd, ifname))
+		start_watchdog(skfd, ifname);
+	
+	/* Set up afterburner, disabled it if WDS is enabled */
+	if (val || nvram_enabled(wl_var("lazywds"))) {
+		val = ABO_OFF;
+	} else {
+		val = ABO_AUTO;
+		if (nvram_enabled(wl_var("afterburner")))
+			val = ABO_ON;
+		if (nvram_disabled(wl_var("afterburner")))
+			val = ABO_OFF;
+	}
+	
+	bcom_set_var(skfd, ifname, "afterburner_override", &val, sizeof(val));
+
 	/* Set up MAC list */
 	if (nvram_match(wl_var("macmode"), "allow"))
 		val = WLC_MACMODE_ALLOW;
@@ -330,25 +601,6 @@ static void setup_bcom(int skfd, char *ifname)
 	}
 	bcom_ioctl(skfd, ifname, WLC_SET_MACMODE, &val, sizeof(val));
 
-	if (ap = !nvram_match(wl_var("mode"), "sta") && !nvram_match(wl_var("mode"), "wet"))
-		wds_enabled = setup_bcom_wds(skfd, ifname);
-
-	if (!ap || wds_enabled)	
-		start_watchdog(skfd, ifname);
-	
-	/* Set up afterburner, disabled it if WDS is enabled */
-	if (wds_enabled) {
-		val = ABO_OFF;
-	} else {
-		val = ABO_AUTO;
-		if (nvram_enabled(wl_var("afterburner")))
-			val = ABO_ON;
-		if (nvram_disabled(wl_var("afterburner")))
-			val = ABO_OFF;
-	}
-	
-	bcom_set_val(skfd, ifname, "afterburner_override", &val, sizeof(val));
-	
 	/* Set up G mode */
 	bcom_ioctl(skfd, ifname, WLC_GET_PHYTYPE, &val, sizeof(val));
 	if (val == 2) {
@@ -385,53 +637,139 @@ static void setup_bcom(int skfd, char *ifname)
 			bcom_ioctl(skfd, ifname, WLC_SET_PLCPHDR, &val, sizeof(val));
 		}
 	}
+}
+
+static void setup_bcom_new(int skfd, char *ifname)
+{
+	int val = 0, i;
+	int iface[16], ifaces = 1;
+	int ap, apsta, sta, wet;
+	char *v;
+
+	if (bcom_ioctl(skfd, ifname, WLC_GET_MAGIC, &val, sizeof(val)) < 0) 
+		return;
+	
+	/* Clear all VIFs */
+	iface[0] = 0;
+	for (i = 0; i < 16; i++) {
+		int cfg[2]; /* index, enabled */
+		
+		cfg[0] = i;
+		cfg[1] = 0;
+		
+		bcom_set_var(skfd, ifname, "bss", cfg, sizeof(cfg));
+		
+		if ((i > 0) && nvram_enabled(vif_var(i, "enabled")) && (i == 0 || nvram_get(vif_var(i, "ssid")))) {
+			iface[ifaces] = i;
+			ifaces++;
+		}
+	}
+
+	set_wext_mode(skfd, ifname);
+	
+	ap = nvram_match(wl_var("mode"), "ap") || nvram_match(wl_var("mode"), "apsta");
+	apsta = nvram_match(wl_var("mode"), "apsta");
+	sta = nvram_match(wl_var("mode"), "sta");
+
+	bcom_set_int(skfd, ifname, "apsta", apsta);
+	bcom_set_int(skfd, ifname, "mssid", (ifaces > 1));
+
+	for (i = 0; i < (sta ? 0 : ifaces); i++) {
+#ifdef DEBUG
+		fprintf(stderr, "setup_bcom_vif(%d) start\n", iface[i]);
+#endif
+		setup_bcom_vif(skfd, ifname, iface[i]);
+#ifdef DEBUG
+		fprintf(stderr, "setup_bcom_vif(%d) end\n", iface[i]);
+#endif
+	}
+
+	
+	if (v = nvram_get(wl_var("rts"))) {
+		val = atoi(v);
+		bcom_set_int(skfd, ifname, "rtsthresh", val);
+	}
+	if (v = nvram_get(wl_var("frag"))) {
+		val = atoi(v);
+		bcom_set_int(skfd, ifname, "fragthresh", val);
+	}
 
+	val = (nvram_disabled(wl_var("radio")) ? (1 | (1 << 16)) : 0);
+	bcom_ioctl(skfd, ifname, WLC_SET_RADIO, &val, sizeof(val));
+
+	setup_bcom_common(skfd, ifname);
 	start_bcom(skfd, ifname);
 
-	if (!(v = nvram_get(wl_var("akm"))))
-		v = nvram_safe_get(wl_var("auth_mode"));
+	val = atoi(nvram_safe_get(wl_var("channel")));
+	if (val > 0)
+		bcom_ioctl(skfd, ifname, WLC_SET_CHANNEL, &val, sizeof(val));
+	
+	val = (ap ? 15 : 0);
+	bcom_ioctl(skfd, ifname, WLC_SET_CS_SCAN_TIMER, &val, sizeof(val));
 	
-	if (strstr(v, "wpa") || strstr(v, "psk")) {
-		wpa_enc = 1;
+	for (i = 0; i < (sta ? 0 : ifaces); i++) {
+		setup_bcom_vif_sec(skfd, ifname, iface[i]);
+	}
 
-		/* Set up WPA */
-		if (nvram_match(wl_var("crypto"), "tkip"))
-			val = TKIP_ENABLED;
-		else if (nvram_match(wl_var("crypto"), "aes"))
-			val = AES_ENABLED;
-		else if (nvram_match(wl_var("crypto"), "tkip+aes") || nvram_match(wl_var("crypto"), "aes+tkip"))
-			val = TKIP_ENABLED | AES_ENABLED;
-		else
-			val = 0;
-		bcom_ioctl(skfd, ifname, WLC_SET_WSEC, &val, sizeof(val));
+	for (i = 0; i < (sta ? 0 : ifaces); i++) {
+		start_bcom_vif(skfd, ifname, iface[i]);
+	}
+}
 
-		if (val && strstr(v, "psk")) {
-			val = (strstr(v, "psk2") ? 0x84 : 0x4);
-			v = nvram_safe_get(wl_var("wpa_psk"));
-			if ((strlen(v) >= 8) && (strlen(v) < 63)) {
-				
-				bcom_ioctl(skfd, ifname, WLC_SET_WPA_AUTH, &val, sizeof(val));
-				
-				if (!nvram_match(wl_var("mode"), "wet")) {
-					/* Enable in-driver WPA supplicant */
-					wsec_pmk_t pmk;
-					
-					pmk.key_len = (unsigned short) strlen(v);
-					pmk.flags = WSEC_PASSPHRASE;
-					strcpy(pmk.key, v);
-					bcom_ioctl(skfd, ifname, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
-					bcom_set_int(skfd, ifname, "sup_wpa", 1);
-				}
-			}
-		} else  {
-			val = 1;
-			bcom_ioctl(skfd, ifname, WLC_SET_EAP_RESTRICT, &val, sizeof(val));
+static void setup_bcom_old(int skfd, char *ifname)
+{
+	int val = 0, i;
+	char buf[8192];
+	char wbuf[80];
+	char *v;
+	
+	if (bcom_ioctl(skfd, ifname, WLC_GET_MAGIC, &val, sizeof(val)) < 0)
+		return;
+	
+	setup_bcom_common(skfd, ifname);
+
+	if (v = nvram_get(wl_var("frag"))) {
+		val = atoi(v);
+		bcom_ioctl(skfd, ifname, WLC_SET_FRAG, &val, sizeof(val));
+	}
+	if (v = nvram_get(wl_var("rts"))) {
+		val = atoi(v);
+		bcom_ioctl(skfd, ifname, WLC_SET_RTS, &val, sizeof(val));
+	}
+	
+	val = nvram_enabled(wl_var("closed"));
+	bcom_ioctl(skfd, ifname, WLC_SET_CLOSED, &val, sizeof(val));
+
+	val = nvram_enabled(wl_var("ap_isolate"));
+	bcom_set_int(skfd, ifname, "ap_isolate", val);
+
+	start_bcom(skfd, ifname);
+	set_wext_ssid(skfd, ifname);
+
+	val = bcom_get_wauth(0);
+	bcom_ioctl(skfd, ifname, WLC_SET_WPA_AUTH, &val, sizeof(val));
+
+	if (val & (WPA_AUTH_PSK | WPA2_AUTH_PSK)) {
+		v = nvram_safe_get(wl_var("wpa_psk"));
+		if ((strlen(v) >= 8) && (strlen(v) < 63) && nvram_match(wl_var("mode"), "wet")) {
+			/* Enable in-driver WPA supplicant */
+			wsec_pmk_t pmk;
+			
+			pmk.key_len = (unsigned short) strlen(v);
+			pmk.flags = WSEC_PASSPHRASE;
+			strcpy(pmk.key, v);
+			bcom_ioctl(skfd, ifname, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+			bcom_set_int(skfd, ifname, "sup_wpa", 1);
 		}
+	}
+	if (val) {
+		val = 1;
+		bcom_ioctl(skfd, ifname, WLC_SET_EAP_RESTRICT, &val, sizeof(val));
+		val = bcom_get_wsec(0);
+		bcom_ioctl(skfd, ifname, WLC_SET_WSEC, &val, sizeof(val));
 	} else {
 		val = 0;
-
 		bcom_ioctl(skfd, ifname, WLC_SET_WSEC, &val, sizeof(val));
-		bcom_ioctl(skfd, ifname, WLC_SET_WPA_AUTH, &val, sizeof(val));
 		bcom_ioctl(skfd, ifname, WLC_SET_EAP_RESTRICT, &val, sizeof(val));
 		bcom_set_int(skfd, ifname, "sup_wpa", 0);
 	}
@@ -487,20 +825,6 @@ static void setup_wext_wep(int skfd, char *ifname)
 	}
 }
 
-static void set_wext_mode(skfd, ifname)
-{
-	struct iwreq wrq;
-	int ap = 0, infra = 0, wet = 0;
-	
-	/* Set operation mode */
-	ap = !nvram_match(wl_var("mode"), "sta") && !nvram_match(wl_var("mode"), "wet");
-	infra = !nvram_disabled(wl_var("infra"));
-	wet = !ap && nvram_match(wl_var("mode"), "wet");
-
-	wrq.u.mode = (!infra ? IW_MODE_ADHOC : (ap ? IW_MODE_MASTER : (wet ? IW_MODE_REPEAT : IW_MODE_INFRA)));
-	IW_SET_EXT_ERR(skfd, ifname, SIOCSIWMODE, &wrq, "Set Mode");
-}
-
 static void setup_wext(int skfd, char *ifname)
 {
 	char *buffer;
@@ -519,7 +843,6 @@ static void setup_wext(int skfd, char *ifname)
 		IW_SET_EXT_ERR(skfd, ifname, SIOCSIWFREQ, &wrq, "Set Frequency");
 	}
 
-
 	/* Disable radio if wlX_radio is set and not enabled */
 	wrq.u.txpower.disabled = nvram_disabled(wl_var("radio"));
 
@@ -552,10 +875,27 @@ static int setup_interfaces(int skfd, char *ifname, char *args[], int count)
 		set_wext_mode(skfd, ifname);
 		setup_wext(skfd, ifname);
 	} else {
-		stop_bcom(skfd, ifname);
-		set_wext_mode(skfd, ifname);
-		setup_bcom(skfd, ifname);
-		setup_wext(skfd, ifname);
+		if (is_new_bcom(skfd, ifname)) {
+#ifdef DEBUG
+			fprintf(stderr, "New Broadcom driver detected.\n");
+#endif
+			stop_bcom(skfd, ifname);
+#ifdef DEBUG
+			fprintf(stderr, "Setup start.\n");
+#endif
+			setup_bcom_new(skfd, ifname);
+#ifdef DEBUG
+			fprintf(stderr, "Setup done.\n");
+#endif
+		} else {
+#ifdef DEBUG
+			fprintf(stderr, "Old Broadcom driver detected.\n");
+#endif
+			stop_bcom(skfd, ifname);
+			set_wext_mode(skfd, ifname);
+			setup_bcom_old(skfd, ifname);
+			setup_wext(skfd, ifname);
+		}
 	}
 	
 	prefix[2]++;
@@ -569,7 +909,7 @@ int main(int argc, char **argv)
 		exit(-1);
 	}
 
-	prefix = strdup("wl0_");
+	prefix = strdup("wl0");
 	iw_enum_devices(skfd, &setup_interfaces, NULL, 0);
 	
 	return 0;