* fix reboot adbd issue

i2c: fix stack buffer overflow vulnerability in i2c md command

buildroot/board/cvitek/SG200X/overlay/etc/adbd_monitor.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+UDC_PATH=/sys/kernel/config/usb_gadget/g0/UDC
+if [ -f /boot/usb.adbd ] && [ -f /boot/usb.dev ];
+then
+    while true; do
+        if [ -z "$(cat $UDC_PATH | tr -d '[:space:]')" ];
+        then
+            echo "try restart usb device"
+            /etc/init.d/S08usbdev stop
+            /etc/init.d/S08usbdev start
+            /etc/init.d/S30gadget_nic restart
+        fi
+        sleep 5
+    done
+fi

buildroot/board/cvitek/SG200X/overlay/etc/init.d/S00kmod

@@ -7,8 +7,8 @@ then
 	cd /mnt/system/ko/
 	insmod soph_sys.ko
 	insmod soph_base.ko
-	insmod soph_rtos_cmdqu.ko
-	insmod soph_fast_image.ko
+	insmod soph_rtos_cmdqu.ko # optional for RTOS core
+	insmod soph_fast_image.ko # optional for RTOS core
 	insmod soph_mipi_rx.ko
 	insmod soph_snsr_i2c.ko
 	insmod soph_vi.ko

buildroot/board/cvitek/SG200X/overlay/etc/init.d/S00pmu

@@ -1,48 +1,62 @@
 #!/bin/sh
 
+PMU_BUS=4
+PMU_ADDR=0x34
+PMU_REG_VER=0x03
+
+pmu_detected() {
+    pmu_version=$(i2cget -y "$PMU_BUS" "$PMU_ADDR" "$PMU_REG_VER" 2>/dev/null)
+    if [ $? -ne 0 ]; then
+        return 1
+    fi
+
+    pmu_version=$((pmu_version & 0xCF))
+    chip_id_1=$((0x47))
+    chip_id_2=$((0x4a))
+
+    if [ "$pmu_version" -eq "$chip_id_1" ] || [ "$pmu_version" -eq "$chip_id_2" ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
 start() {
-	if ! command -v i2cget &> /dev/null
-	then
-	    echo "i2cdetect not find, please install i2c-tools"
-	    exit 1
-	fi
+    # if ! command -v i2cget &> /dev/null; then
+    #     echo "i2cget not found, please install i2c-tools"
+    #     exit 1
+    # fi
 
-	pmu_version=$(i2cget -y 4 0x34 0x03)
-	pmu_version=$((pmu_version & 0xCF))
-
-	chip_id_1=$(printf "%d" 0x47)
-	chip_id_2=$(printf "%d" 0x4a)
-
-	if [ "$pmu_version" -eq "$chip_id_1" ] || [ "$pmu_version" -eq "$chip_id_2" ]; then
-		exec /usr/bin/axp2101
-		echo "Starting PMU: OK\n"
-	fi
+    if pmu_detected; then
+        exec /usr/bin/axp2101
+    else
+        echo "No PMU, skip"
+    fi
 }
 
 stop() {
-    runlevel=$(cat /run/runlevel | awk '{ print $1 }')
-    if [ "$runlevel" = "0" ]; then
-        printf "Stopping PMU\n"
-        value=$(i2cget -y 4 0x34 0x10)
-        value=$((value | 0x01))
-        i2cset -y 4 0x34 0x10 $value
+    if pmu_detected; then
+        runlevel=$(cat /run/runlevel | awk '{ print $1 }')
+        if [ "$runlevel" = "0" ]; then
+            echo "Stopping PMU"
+            value=$(i2cget -y "$PMU_BUS" "$PMU_ADDR" 0x10)
+            value=$((value | 0x01))
+            i2cset -y "$PMU_BUS" "$PMU_ADDR" 0x10 $value
+        fi
+    else
+        echo "No PMU, skip"
     fi
 }
 
 case "$1" in
     start)
-        if grep -q "pmu=axp2101" /boot/board 2>/dev/null; then
-            start
-        fi
+        start
         ;;
     stop)
-        if grep -q "pmu=axp2101" /boot/board 2>/dev/null; then
-            stop
-        fi
+        stop
         ;;
     *)
-        echo "Usage: /etc/init.d/S00pmu {start}"
+        echo "Usage: $0 {start|stop}"
         exit 1
         ;;
 esac
-

buildroot/board/cvitek/SG200X/overlay/etc/init.d/S05tp

@@ -11,16 +11,16 @@ then
 	then
 		panel_value=$(grep '^panel=' /boot/uEnv.txt | cut -d '=' -f 2)
 	fi
-	if [ "$panel_value" = "st7701_lct024bsi20" ]
+	if [ "$panel_value" = "st7701_lct024bsi20" ] # MaixCAM-Pro
 	then
 		echo "load cst7xx touchscreen driver"
 		insmod /mnt/system/ko/hynitron_touch_new.ko
-	elif [ "$panel_value" = "st7701_hd228001c31" ]
+	elif [ "$panel_value" = "st7701_hd228001c31" ] # MaixCAM
 	then
 		echo "load cst3xx touchscreen driver"
 		insmod /mnt/system/ko/hynitron_touch.ko
 	fi
-	if [ -e /boot/gt9xx ]
+	elif [ "$panel_value" = "mtd700920b" ] # 7-inch touchscreen
 	then
 		echo "load gt9xx touchscreen driver"
 		insmod /mnt/system/ko/3rd/gt9xx.ko

buildroot/board/cvitek/SG200X/overlay/etc/init.d/S08usbdev

@@ -196,6 +196,13 @@ then
 			sleep 0.4
 		done
 		echo device > /proc/cviusb/otg_role
+
+        if [ -e /boot/usb.adbd ]
+        then
+            if [ -z "$(ps aux | grep adbd_monitor | grep -v grep)" ]; then
+                /etc/adbd_monitor.sh &
+            fi
+        fi
 	fi
 fi
 
@@ -222,5 +229,16 @@ then
 		unlink /sys/kernel/config/usb_gadget/g0/configs/c.1/ncm.usb0
 		rmdir /sys/kernel/config/usb_gadget/g0/functions/ncm.usb0
 	fi
+
+    # adbd
+     if [ -e /sys/kernel/config/usb_gadget/g0/configs/c.1/ffs.adb ]
+     then
+        adbd_pid=$(ps aux | grep '/usr/bin/adbd' | grep -v grep | awk '{print $1}')
+        kill -15 $adbd_pid
+        umount /dev/usb-ffs/adb
+        rm /dev/usb-ffs/adb -rf
+        unlink /sys/kernel/config/usb_gadget/g0/configs/c.1/ffs.adb
+        rmdir /sys/kernel/config/usb_gadget/g0/functions/ffs.adb
+     fi
 fi
 

buildroot/configs/cvitek_SG200X_musl_riscv64_defconfig

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Buildroot -ga3ccb527b-dirty Configuration
+# Buildroot -g6073d5d3e Configuration
 #
 BR2_HAVE_DOT_CONFIG=y
 BR2_HOST_GCC_AT_LEAST_4_9=y
@@ -3127,7 +3127,22 @@ BR2_PACKAGE_IW=y
 # BR2_PACKAGE_KSMBD_TOOLS is not set
 # BR2_PACKAGE_LEAFNODE2 is not set
 # BR2_PACKAGE_LFT is not set
-# BR2_PACKAGE_LFTP is not set
+BR2_PACKAGE_LFTP=y
+
+#
+# Commands
+#
+BR2_PACKAGE_LFTP_CMD_MIRROR=y
+BR2_PACKAGE_LFTP_CMD_SLEEP=y
+# BR2_PACKAGE_LFTP_CMD_TORRENT is not set
+
+#
+# Protocols
+#
+BR2_PACKAGE_LFTP_PROTO_FISH=y
+BR2_PACKAGE_LFTP_PROTO_FTP=y
+BR2_PACKAGE_LFTP_PROTO_HTTP=y
+BR2_PACKAGE_LFTP_PROTO_SFTP=y
 # BR2_PACKAGE_LIGHTTPD is not set
 # BR2_PACKAGE_LINKNX is not set
 # BR2_PACKAGE_LINKS is not set
@@ -3301,7 +3316,7 @@ BR2_PACKAGE_TRACEROUTE=y
 # BR2_PACKAGE_VDR is not set
 # BR2_PACKAGE_VNSTAT is not set
 # BR2_PACKAGE_VPNC is not set
-# BR2_PACKAGE_VSFTPD is not set
+BR2_PACKAGE_VSFTPD=y
 # BR2_PACKAGE_VTUN is not set
 # BR2_PACKAGE_WAVEMON is not set
 # BR2_PACKAGE_WGET is not set

buildroot/package/aic8800-sdio-firmware/aic8800-sdio-firmware.mk

@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-AIC8800_SDIO_FIRMWARE_VERSION = e44a51d3c129bbd7413848a430b8206556e923a5
-AIC8800_SDIO_FIRMWARE_SITE = $(call github,0x754C,aic8800-sdio-firmware,$(AIC8800_SDIO_FIRMWARE_VERSION))
+AIC8800_SDIO_FIRMWARE_VERSION = c56f910044cc854d6c553bcb9a644f3bca5a4c38
+AIC8800_SDIO_FIRMWARE_SITE = $(call github,lxowalle,aic8800-sdio-firmware,$(AIC8800_SDIO_FIRMWARE_VERSION))
 
 define AIC8800_SDIO_FIRMWARE_INSTALL_TARGET_CMDS
 	mkdir -pv $(TARGET_DIR)/usr/lib/firmware/aic8800_sdio/

osdrv/extdrv/wireless/aic8800/.gitignore

@@ -1,3 +1,5 @@
 *.symvers
 *.order
+*.symvers.cmd
+*.order.cmd
 .tmp_versions/

osdrv/extdrv/wireless/aic8800/Kconfig

@@ -8,7 +8,7 @@ config AIC_FW_PATH
 	depends on AIC_WLAN_SUPPORT
 	string "Firmware & config file path"
 	#default "/vendor/etc/firmware"
-	default "/lib/firmware/aic8800_sdio/aic8800"
+	default "/usr/lib/firmware/aic8800_sdio/aic8800_and_aic8800D80"
 	help
 	  Path to the firmware & config file.
 

osdrv/extdrv/wireless/aic8800/Makefile

@@ -6,51 +6,54 @@ obj-$(CONFIG_AIC8800_BTLPM_SUPPORT) += aic8800_btlpm/
 obj-$(CONFIG_AIC8800_WLAN_SUPPORT) += aic8800_fdrv/
 obj-$(CONFIG_AIC_WLAN_SUPPORT) += aic8800_bsp/
 
+MAKEFLAGS +=-j$(shell nproc)
 
-# Platform support list
-CONFIG_PLATFORM_ROCKCHIP = n
-CONFIG_PLATFORM_ROCKCHIP2 = n
-CONFIG_PLATFORM_ALLWINNER = n
-CONFIG_PLATFORM_AMLOGIC = n
-CONFIG_PLATFORM_UBUNTU = y
+########## config option ##########
+export CONFIG_USE_FW_REQUEST = n
+export CONFIG_PREALLOC_RX_SKB = y
+export CONFIG_PREALLOC_TXQ = y
+export CONFIG_OOB = n
+export CONFIG_GPIO_WAKEUP = n
+export CONFIG_RESV_MEM_SUPPORT = y
+###################################
 
+########## Platform support list ##########
+export CONFIG_PLATFORM_ROCKCHIP = n
+export CONFIG_PLATFORM_ROCKCHIP2 = n
+export CONFIG_PLATFORM_ALLWINNER = n
+export CONFIG_PLATFORM_AMLOGIC = n
+export CONFIG_PLATFORM_UBUNTU = y
 
 ifeq ($(CONFIG_PLATFORM_ROCKCHIP), y)
-#KDIR = /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/kernel
-#ARCH = arm
-#CROSS_COMPILE = /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
-KDIR  = /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/kernel
-ARCH = arm
-CROSS_COMPILE = /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/prebuilts/gcc/linux-x86/arm/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR  = /home/yaya/E/Rockchip/3399/rk3399-android-10/kernel
-#ARCH = arm64
-#CROSS_COMPILE = /home/yaya/E/Rockchip/3399/rk3399-android-10/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
+ARCH = arm64
+KDIR = /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/kernel
+CROSS_COMPILE = /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
 ccflags-y += -DANDROID_PLATFORM
 ccflags-y += -DCONFIG_PLATFORM_ROCKCHIP
 endif
 
 ifeq ($(CONFIG_PLATFORM_ROCKCHIP2), y)
-ARCH = arm64
-KDIR = /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/kernel
-CROSS_COMPILE = /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
+KDIR := /home/yaya/E/Rockchip/3126/Android6/kernel
+ARCH ?= arm
+CROSS_COMPILE ?= /home/yaya/E/Rockchip/3288/Android5/rk3288_JHY/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
 ccflags-y += -DANDROID_PLATFORM
 ccflags-y += -DCONFIG_PLATFORM_ROCKCHIP2
 endif
 
-
 ifeq ($(CONFIG_PLATFORM_ALLWINNER), y)
-KDIR  = /home/yaya/E/Allwinner/R818/R818/AndroidQ/lichee/kernel/linux-4.9
+KDIR  = /home/yaya/E/Allwinner/A133/Android10/linux-4.9
 ARCH = arm64
-CROSS_COMPILE = /home/yaya/E/Allwinner/R818/R818/AndroidQ/lichee/out/gcc-linaro-5.3.1-2016.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
+CROSS_COMPILE = /home/yaya/E/Allwinner/r818/Android10/lichee/out/gcc-linaro-5.3.1-2016.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
+export CONFIG_SUPPORT_LPM = y
 ccflags-y += -DANDROID_PLATFORM
 endif
 
 ifeq ($(CONFIG_PLATFORM_AMLOGIC), y)
-ccflags-y += -DANDROID_PLATFORM
 ARCH = arm
 CROSS_COMPILE = /home/yaya/D/Workspace/CyberQuantum/JinHaoYue/amls905x3/SDK/20191101-0tt-asop/android9.0/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9/bin/arm-linux-androidkernel-
 KDIR = /home/yaya/D/Workspace/CyberQuantum/JinHaoYue/amls905x3/SDK/20191101-0tt-asop/android9.0/out/target/product/u202/obj/KERNEL_OBJ/
-
+ccflags-y += -DANDROID_PLATFORM
+export CONFIG_SUPPORT_LPM = y
 endif
 
 ifeq ($(CONFIG_PLATFORM_UBUNTU), y)
@@ -58,9 +61,12 @@ KDIR  = /lib/modules/$(shell uname -r)/build
 PWD   = $(shell pwd)
 KVER = $(shell uname -r)
 MODDESTDIR = /lib/modules/$(KVER)/kernel/drivers/net/wireless/aic8800
-ARCH = x86_64
-CROSS_COMPILE =
+SUBARCH = $(shell uname -m | sed -e s/i.86/i386/ -e s/armv.l/arm/ -e s/aarch64/arm64/)
+ARCH ?= $(SUBARCH)
+CROSS_COMPILE ?=
 endif
+###########################################
+
 all: modules
 modules:
 	make -C $(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
@@ -82,5 +88,5 @@ clean:
 	cd aic8800_bsp/;make clean;cd ..
 	cd aic8800_fdrv/;make clean;cd ..
 	cd aic8800_btlpm/;make clean;cd ..
-	rm -rf modules.order Module.symvers .tmp_versions/
+	rm -rf modules.order Module.symvers .modules.order.cmd .Module.symvers.cmd .tmp_versions/
 

osdrv/extdrv/wireless/aic8800/aic8800_bsp/Makefile

@@ -1,8 +1,8 @@
 CONFIG_SDIO_SUPPORT := y
-CONFIG_SDIO_PWRCTRL := y
+CONFIG_SDIO_PWRCTRL := n
 #CONFIG_AIC_FW_PATH = "/vendor/etc/firmware"
-#CONFIG_AIC_FW_PATH ?= "/lib/firmware/aic8800_sdio/aic8800"
-
+#CONFIG_AIC_FW_PATH = "/lib/firmware/aic8800D80"
+CONFIG_AIC_FW_PATH = "/usr/lib/firmware/aic8800_sdio/aic8800_and_aic8800D80"
 export CONFIG_AIC_FW_PATH
 ccflags-y += -DCONFIG_AIC_FW_PATH=\"$(CONFIG_AIC_FW_PATH)\"
 
@@ -12,24 +12,36 @@ ccflags-y += -DAICWF_SDIO_SUPPORT
 ccflags-$(CONFIG_SDIO_PWRCTRL) += -DCONFIG_SDIO_PWRCTRL
 endif
 
-CONFIG_GPIO_WAKEUP = n
+CONFIG_GPIO_WAKEUP ?= n
 CONFIG_M2D_OTA_AUTO_SUPPORT = n
 CONFIG_M2D_OTA_LZMA_SUPPORT = n
 CONFIG_LINK_DET_5G = y
 CONFIG_MCU_MESSAGE = n
 CONFIG_FIRMWARE_ARRAY = n
 # Need to set fw path in BOARD_KERNEL_CMDLINE
-CONFIG_USE_FW_REQUEST = n
+CONFIG_USE_FW_REQUEST ?= n
 CONFIG_FDRV_NO_REG_SDIO = n
 CONFIG_VRF_DCDC_MODE = y
-CONFIG_OOB = n
+CONFIG_OOB ?= n
 CONFIG_PREALLOC_TXQ = y
-CONFIG_ONE_TXQ = n
 CONFIG_DPD = y
 CONFIG_FORCE_DPD_CALIB = y
-CONFIG_RESV_MEM_SUPPORT = y
-CONFIG_AMSDU_RX ?=n
+CONFIG_LOFT_CALIB = n
+CONFIG_EXT_FEM_8800DCDW = n
+CONFIG_RESV_MEM_SUPPORT ?= y
+CONFIG_AMSDU_RX = y
 CONFIG_IRQ_FALL ?= n
+CONFIG_SDIO_BT = y
+CONFIG_RADAR_OR_IR_DETECT =n
+CONFIG_FOR_IPCAM = n
+CONFIG_BAND_STEERING = n
+CONFIG_PRBREQ_REPORT = n
+
+ifeq ($(CONFIG_EXT_FEM_8800DCDW), y)
+CONFIG_DPD = n
+CONFIG_FORCE_DPD_CALIB = n
+CONFIG_LOFT_CALIB = y
+endif
 
 ccflags-$(CONFIG_GPIO_WAKEUP) += -DCONFIG_GPIO_WAKEUP
 ccflags-$(CONFIG_M2D_OTA_AUTO_SUPPORT) += -DCONFIG_M2D_OTA_AUTO_SUPPORT
@@ -42,17 +54,25 @@ ccflags-$(CONFIG_FDRV_NO_REG_SDIO) += -DCONFIG_FDRV_NO_REG_SDIO
 ccflags-$(CONFIG_VRF_DCDC_MODE) += -DCONFIG_VRF_DCDC_MODE
 ccflags-$(CONFIG_OOB) += -DCONFIG_OOB
 ccflags-$(CONFIG_PREALLOC_TXQ) += -DCONFIG_PREALLOC_TXQ
-ccflags-$(CONFIG_ONE_TXQ)  += -DCONFIG_ONE_TXQ
 ccflags-$(CONFIG_DPD)  += -DCONFIG_DPD
 ccflags-$(CONFIG_FORCE_DPD_CALIB) += -DCONFIG_FORCE_DPD_CALIB -DCONFIG_DPD
+ccflags-$(CONFIG_LOFT_CALIB) += -DCONFIG_LOFT_CALIB
+ccflags-$(CONFIG_EXT_FEM_8800DCDW) += -DCONFIG_EXT_FEM_8800DCDW
 ccflags-$(CONFIG_RESV_MEM_SUPPORT) += -DCONFIG_RESV_MEM_SUPPORT
 ccflags-$(CONFIG_AMSDU_RX) += -DCONFIG_AMSDU_RX
 ccflags-$(CONFIG_IRQ_FALL) += -DCONFIG_IRQ_FALL
+ccflags-$(CONFIG_SDIO_BT) += -DCONFIG_SDIO_BT
+ccflags-$(CONFIG_RADAR_OR_IR_DETECT) += -DCONFIG_RADAR_OR_IR_DETECT
+ccflags-$(CONFIG_FOR_IPCAM) += -DCONFIG_FOR_IPCAM
+ccflags-$(CONFIG_BAND_STEERING) += -DCONFIG_BAND_STEERING
+ccflags-$(CONFIG_PRBREQ_REPORT) += -DCONFIG_PRBREQ_REPORT
+
 
 obj-m := $(MODULE_NAME).o
 $(MODULE_NAME)-y := \
 	aic8800dc_compat.o \
 	aic8800d80_compat.o \
+	aic8800d80x2_compat.o \
 	aic_bsp_main.o \
 	aic_bsp_driver.o \
 	aicsdio.o \
@@ -65,7 +85,7 @@ ifeq ($(CONFIG_FIRMWARE_ARRAY),y)
 $(MODULE_NAME)-y +=	aicwf_firmware_array.o
 endif
 
-# Platform support list
+########## Platform support list ##########
 CONFIG_PLATFORM_ROCKCHIP ?= n
 CONFIG_PLATFORM_ROCKCHIP2 ?= n
 CONFIG_PLATFORM_ALLWINNER ?=n
@@ -75,26 +95,6 @@ CONFIG_PLATFORM_UBUNTU ?= y
 
 ifeq ($(CONFIG_PLATFORM_ROCKCHIP), y)
 ccflags-$(CONFIG_PLATFORM_ROCKCHIP) += -DCONFIG_PLATFORM_ROCKCHIP
-#KDIR  ?= /home/yaya/E/Rockchip/3399/rk3399-android-10/kernel
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3399/rk3399-android-10/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
-#KDIR  ?= /home/yaya/E/Rockchip/3288/Android10/kernel/kernel/
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3288/Android10/tool/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR ?= /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/kernel
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
-#KDIR  ?= /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/kernel
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/prebuilts/gcc/linux-x86/arm/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR ?= /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/kernel
-#KDIR ?= /home/yaya/E/Rockchip/3566/oudu/kernel
-#KDIR ?= /home/yaya/E/Rockchip/3566/shengteng/kernel
-#ARCH ?= arm64
-#CROSS_COMPILE ?= ~/E/Rockchip/3566/Android11/rk3566_rk3568_android11_oranth/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
-#KDIR ?= /home/yaya/E/Rockchip/3328/Android9/SDK/kernel/
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3328/Android9/SDK/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
 KDIR ?= /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/kernel
 ARCH ?= arm64
 CROSS_COMPILE ?= /home/yaya/E/Rockchip/3566/Android11/rk3566_rk3568_android11_oranth/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
@@ -109,9 +109,6 @@ endif
 
 ifeq ($(CONFIG_PLATFORM_ALLWINNER), y)
 ccflags-$(CONFIG_PLATFORM_ALLWINNER) += -DCONFIG_PLATFORM_ALLWINNER
-#KDIR  ?= /home/yaya/E/Allwinner/A133/a133-sdk/android/longan/out/kernel/build/
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Allwinner/A133/a133-sdk/android/longan/out/gcc-linaro-5.3.1-2016.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
 KDIR  ?= /home/yaya/E/Allwinner/r818/Android10/lichee/kernel/linux-4.9/
 ARCH ?= arm64
 CROSS_COMPILE ?= /home/yaya/E/Allwinner/r818/Android10/android/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin/aarch64-linux-android-
@@ -140,7 +137,7 @@ MODDESTDIR ?= /lib/modules/$(KVER)/kernel/drivers/net/wireless/
 ARCH ?= x86_64
 CROSS_COMPILE ?=
 endif
-
+###########################################
 
 all: modules
 modules:

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic8800d80_compat.c

@@ -47,6 +47,27 @@ u32 adaptivity_patch_tbl_8800d80[][2] = {
 	{0x0168, 0x00010000}, //tx_adaptivity_en
 };
 
+#define USER_PWROFST_COVER_CALIB_FLAG	0x01U
+#define USER_CHAN_MAX_TXPWR_EN_FLAG     (0x01U << 1)
+#define USER_TX_USE_ANA_F_FLAG          (0x01U << 2)
+#define USER_APM_PRBRSP_OFFLOAD_DISABLE_FLAG    (0x01U << 3)
+#define USER_HE_MU_EDCA_UPDATE_DISABLE_FLAG     (0x01U << 4)
+#define USER_LOFT_CALIB_DISABLE_FLAG    (0x01U << 6)
+#define USER_CAPA_CALIB_DISABLE_FLAG    (0x01U << 7)
+#define USER_PWR_CALIB_DISABLE_FLAG     (0x01U << 8)
+
+#define CFG_PWROFST_COVER_CALIB     1
+#define CFG_USER_CHAN_MAX_TXPWR_EN  1
+#define CFG_USER_TX_USE_ANA_F       0
+#ifdef CONFIG_PRBREQ_REPORT
+#define CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE 1
+#else
+#define CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE 0
+#endif
+
+
+#define CFG_USER_EXT_FLAGS_EN   (CFG_PWROFST_COVER_CALIB || CFG_USER_CHAN_MAX_TXPWR_EN || CFG_USER_TX_USE_ANA_F || CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE)
+
 u32 patch_tbl_8800d80[][2] = {
 	#ifdef USE_5G
 	{0x00b4, 0xf3010001},
@@ -54,11 +75,33 @@ u32 patch_tbl_8800d80[][2] = {
 	{0x00b4, 0xf3010000},
 	#endif
 #if defined(CONFIG_AMSDU_RX)
-        {0x170, 0x0100000a}
+        {0x170, 0x0100000a},
 #endif
 #ifdef CONFIG_IRQ_FALL
 	{0x00000170, 0x0000010a}, //irqf
 #endif
+
+	#if CFG_USER_EXT_FLAGS_EN
+	{0x0188, 0x00000000
+	#if CFG_PWROFST_COVER_CALIB
+		| USER_PWROFST_COVER_CALIB_FLAG
+	#endif
+	#if CFG_USER_CHAN_MAX_TXPWR_EN
+		| USER_CHAN_MAX_TXPWR_EN_FLAG
+	#endif
+	#if CFG_USER_TX_USE_ANA_F
+		| USER_TX_USE_ANA_F_FLAG
+	#endif
+	#if CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE
+		| USER_APM_PRBRSP_OFFLOAD_DISABLE_FLAG
+	#endif
+        //| USER_CAPA_CALIB_DISABLE_FLAG
+	}, // user_ext_flags
+	#endif
+
+#ifdef CONFIG_RADAR_OR_IR_DETECT
+	{0x019c, 0x00000900}, //enable radar detect
+#endif
 };
 
 #ifdef CONFIG_OOB
@@ -90,11 +133,16 @@ int aicwifi_sys_config_8800d80(struct aic_sdio_dev *sdiodev)
 	return 0;
 }
 
+#define NEW_PATCH_BUFFER_MAP    1
+
 int aicwifi_patch_config_8800d80(struct aic_sdio_dev *sdiodev)
 {
 	const u32 rd_patch_addr = RAM_FMAC_FW_ADDR + 0x0198;
 	u32 aic_patch_addr;
 	u32 config_base, aic_patch_str_base;
+	#if (NEW_PATCH_BUFFER_MAP)
+	u32 patch_buff_addr, patch_buff_base, rd_version_addr, rd_version_val;
+	#endif
 	uint32_t start_addr = 0x0016F800;
 	u32 patch_addr = start_addr;
 	u32 patch_cnt = sizeof(patch_tbl_8800d80)/sizeof(u32)/2;
@@ -126,6 +174,27 @@ int aicwifi_patch_config_8800d80(struct aic_sdio_dev *sdiodev)
 	}
 	aic_patch_str_base = rd_patch_addr_cfm.memdata;
 
+	#if (NEW_PATCH_BUFFER_MAP)
+	rd_version_addr = RAM_FMAC_FW_ADDR + 0x01C;
+	if ((ret = rwnx_send_dbg_mem_read_req(sdiodev, rd_version_addr, &rd_patch_addr_cfm))) {
+		printk("version val[0x%x] rd fail: %d\n", rd_version_addr, ret);
+		return ret;
+	}
+	rd_version_val = rd_patch_addr_cfm.memdata;
+	printk("rd_version_val=%08X\n", rd_version_val);
+	sdiodev->fw_version_uint = rd_version_val;
+	if (rd_version_val > 0x06090100) {
+		patch_buff_addr = rd_patch_addr + 12;
+		ret = rwnx_send_dbg_mem_read_req(sdiodev, patch_buff_addr, &rd_patch_addr_cfm);
+		if (ret) {
+			printk("patch buf rd fail\n");
+			return ret;
+		}
+		patch_buff_base = rd_patch_addr_cfm.memdata;
+		patch_addr = start_addr = patch_buff_base;
+	}
+	#endif
+
 	ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(magic_num), AIC_PATCH_MAGIG_NUM);
 	if (ret) {
 		printk("0x%x write fail\n", AIC_PATCH_ADDR(magic_num));

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic8800d80x2_compat.c

@@ -0,0 +1,199 @@
+#include "aic8800d80x2_compat.h"
+#include "aic_bsp_driver.h"
+
+#define USER_PWROFST_COVER_CALIB_FLAG           (0x01U << 0)
+#define USER_CHAN_MAX_TXPWR_EN_FLAG             (0x01U << 1)
+#define USER_TX_USE_ANA_F_FLAG                  (0x01U << 2)
+#define USER_APM_PRBRSP_OFFLOAD_DISABLE_FLAG    (0x01U << 3)
+#define USER_HE_MU_EDCA_UPDATE_DISABLE_FLAG     (0x01U << 4)
+
+#define RAM_FMAC_FW_ADDR_8800D80X2           0x120000
+#define RAM_FMAC_RF_FW_ADDR_8800D80X2        0x120000
+
+#define CFG_USER_CHAN_MAX_TXPWR_EN  1
+#define CFG_USER_TX_USE_ANA_F       0
+#ifdef CONFIG_PRBREQ_REPORT
+#define CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE 1
+#else
+#define CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE 0
+#endif
+
+extern int adap_test;
+#define NEW_PATCH_BUFFER_MAP    1
+#define AIC_PATCH_MAGIG_NUM     0x48435450 // "PTCH"
+#define AIC_PATCH_MAGIG_NUM_2   0x50544348 // "HCTP"
+#define AIC_PATCH_BLOCK_MAX     4
+extern struct aicbsp_info_t aicbsp_info;
+extern int adap_test;
+
+typedef u32 (*array2_tbl_t)[2];
+
+typedef struct {
+    uint32_t magic_num;
+    uint32_t pair_start;
+    uint32_t magic_num_2;
+    uint32_t pair_count;
+    uint32_t block_dst[AIC_PATCH_BLOCK_MAX];
+    uint32_t block_src[AIC_PATCH_BLOCK_MAX];
+    uint32_t block_size[AIC_PATCH_BLOCK_MAX]; // word count
+} aic_patch_t;
+
+#define AIC_PATCH_OFST(mem) ((size_t) &((aic_patch_t *)0)->mem)
+#define AIC_PATCH_ADDR(mem) ((u32) (aic_patch_str_base + AIC_PATCH_OFST(mem)))
+
+
+u32 patch_tbl_d80x2[][2] =
+{
+    {0x021c, 0x04000000},//hs amsdu
+    {0x0220, 0x04010101},//ss amsdu
+    {0x0224, 0x50000a01},//hs aggr
+    {0x0228, 0x50000a00},//ss aggr
+
+    {0x01f0, 0x00000001
+        #if CFG_USER_CHAN_MAX_TXPWR_EN
+        | USER_CHAN_MAX_TXPWR_EN_FLAG
+        #endif
+        #if CFG_USER_TX_USE_ANA_F
+        | USER_TX_USE_ANA_F_FLAG
+        #endif
+        #if CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE
+        | USER_APM_PRBRSP_OFFLOAD_DISABLE_FLAG
+        #endif
+    }, // user_ext_flags
+};
+
+//adap test
+u32 adaptivity_patch_tbl_d80x2[][2] = {
+    {0x000C, 0x0000320A}, //linkloss_thd
+    {0x009C, 0x00000000}, //ac_param_conf
+    {0x01D0, 0x00010000}, //tx_adaptivity_en
+};
+
+
+int aicwifi_patch_config_8800d80x2(struct aic_sdio_dev *sdiodev)
+{
+    u32 rd_patch_addr;
+    u32 aic_patch_addr;
+    u32 config_base, aic_patch_str_base;
+    #if (NEW_PATCH_BUFFER_MAP)
+    u32 patch_buff_addr, patch_buff_base, rd_version_addr, rd_version_val;
+    #endif
+    uint32_t start_addr;
+    u32 patch_addr;
+    u32 patch_cnt = sizeof(patch_tbl_d80x2) / 4 / 2;
+    struct dbg_mem_read_cfm rd_patch_addr_cfm;
+    int ret = 0;
+    int cnt = 0;
+    //adap test
+    int adap_patch_cnt = 0;
+
+    if (adap_test) {
+        AICWFDBG(LOGINFO, "%s adap test \r\n", __func__);
+        adap_patch_cnt = sizeof(adaptivity_patch_tbl_d80x2)/sizeof(u32)/2;
+    }
+
+    rd_patch_addr = RAM_FMAC_FW_ADDR_8800D80X2 + 0x01A8;
+    aic_patch_addr = rd_patch_addr + 8;
+
+    AICWFDBG(LOGINFO, "Read FW mem: %08x\n", rd_patch_addr);
+    if ((ret = rwnx_send_dbg_mem_read_req(sdiodev, rd_patch_addr, &rd_patch_addr_cfm))) {
+        AICWFDBG(LOGERROR, "setting base[0x%x] rd fail: %d\n", rd_patch_addr, ret);
+        return ret;
+    }
+    AICWFDBG(LOGINFO, "rd_patch_addr_cfm %x=%x\n", rd_patch_addr_cfm.memaddr, rd_patch_addr_cfm.memdata);
+    config_base = rd_patch_addr_cfm.memdata;
+
+    if ((ret = rwnx_send_dbg_mem_read_req(sdiodev, aic_patch_addr, &rd_patch_addr_cfm))) {
+        AICWFDBG(LOGERROR, "patch_str_base[0x%x] rd fail: %d\n", aic_patch_addr, ret);
+        return ret;
+    }
+    AICWFDBG(LOGINFO, "rd_patch_addr_cfm %x=%x\n", rd_patch_addr_cfm.memaddr, rd_patch_addr_cfm.memdata);
+    aic_patch_str_base = rd_patch_addr_cfm.memdata;
+
+    #if (NEW_PATCH_BUFFER_MAP)
+    rd_version_addr = RAM_FMAC_FW_ADDR_8800D80X2 + 0x01C;
+    if ((ret = rwnx_send_dbg_mem_read_req(sdiodev, rd_version_addr, &rd_patch_addr_cfm))) {
+        AICWFDBG(LOGERROR, "version val[0x%x] rd fail: %d\n", rd_version_addr, ret);
+        return ret;
+    }
+    rd_version_val = rd_patch_addr_cfm.memdata;
+    AICWFDBG(LOGINFO, "rd_version_val=%08X\n", rd_version_val);
+    sdiodev->fw_version_uint = rd_version_val;
+    patch_buff_addr = rd_patch_addr + 12;
+    ret = rwnx_send_dbg_mem_read_req(sdiodev, patch_buff_addr, &rd_patch_addr_cfm);
+    if (ret) {
+        AICWFDBG(LOGERROR, "patch buf rd fail\n");
+        return ret;
+    }
+    AICWFDBG(LOGINFO, "rd_patch_addr_cfm %x=%x\n", rd_patch_addr_cfm.memaddr, rd_patch_addr_cfm.memdata);
+    patch_buff_base = rd_patch_addr_cfm.memdata;
+    patch_addr = start_addr = patch_buff_base;
+    #endif
+
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(magic_num), AIC_PATCH_MAGIG_NUM))) {
+        AICWFDBG(LOGERROR, "maigic_num[0x%x] write fail: %d\n", AIC_PATCH_ADDR(magic_num), ret);
+        return ret;
+    }
+
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(magic_num_2), AIC_PATCH_MAGIG_NUM_2))) {
+        AICWFDBG(LOGERROR, "maigic_num[0x%x] write fail: %d\n", AIC_PATCH_ADDR(magic_num_2), ret);
+        return ret;
+    }
+
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(pair_start), patch_addr))) {
+        AICWFDBG(LOGERROR, "pair_start[0x%x] write fail: %d\n", AIC_PATCH_ADDR(pair_start), ret);
+        return ret;
+    }
+
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(pair_count), patch_cnt + adap_patch_cnt))) {
+        AICWFDBG(LOGERROR, "pair_count[0x%x] write fail: %d\n", AIC_PATCH_ADDR(pair_count), ret);
+        return ret;
+    }
+
+    for (cnt = 0; cnt < patch_cnt; cnt++) {
+        if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, start_addr+8*cnt, patch_tbl_d80x2[cnt][0]+config_base))) {
+            AICWFDBG(LOGERROR, "%x write fail\n", start_addr+8*cnt);
+            return ret;
+        }
+        if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, start_addr+8*cnt+4, patch_tbl_d80x2[cnt][1]))) {
+            AICWFDBG(LOGERROR, "%x write fail\n", start_addr+8*cnt+4);
+            return ret;
+        }
+    }
+
+    if (adap_test){
+        int tmp_cnt = patch_cnt + adap_patch_cnt;
+        AICWFDBG(LOGINFO, "%s set adap_test patch \r\n", __func__);
+        for (cnt = patch_cnt; cnt < tmp_cnt; cnt++) {
+            int tbl_idx = cnt - patch_cnt;
+            if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, start_addr+8*cnt, adaptivity_patch_tbl_d80x2[tbl_idx][0]+config_base))) {
+                AICWFDBG(LOGERROR, "%x write fail\n", start_addr+8*cnt);
+            return ret;
+            }
+            if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, start_addr+8*cnt+4, adaptivity_patch_tbl_d80x2[tbl_idx][1]))) {
+                AICWFDBG(LOGERROR, "%x write fail\n", start_addr+8*cnt+4);
+            return ret;
+            }
+        }
+    }
+
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(block_size[0]), 0))) {
+        AICWFDBG(LOGERROR, "block_size[0x%x] write fail: %d\n", AIC_PATCH_ADDR(block_size[0]), ret);
+        return ret;
+    }
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(block_size[1]), 0))) {
+        AICWFDBG(LOGERROR, "block_size[0x%x] write fail: %d\n", AIC_PATCH_ADDR(block_size[1]), ret);
+        return ret;
+    }
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(block_size[2]), 0))) {
+        AICWFDBG(LOGERROR, "block_size[0x%x] write fail: %d\n", AIC_PATCH_ADDR(block_size[2]), ret);
+        return ret;
+    }
+    if ((ret = rwnx_send_dbg_mem_write_req(sdiodev, AIC_PATCH_ADDR(block_size[3]), 0))) {
+        AICWFDBG(LOGERROR, "block_size[0x%x] write fail: %d\n", AIC_PATCH_ADDR(block_size[3]), ret);
+        return ret;
+    }
+
+    return 0;
+}
+

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic8800d80x2_compat.h

@@ -0,0 +1,12 @@
+#ifndef _AIC8800D80x2_COMPAT_H_
+#define _AIC8800D80x2_COMPAT_H_
+
+#include "aicsdio.h"
+
+
+int aicwifi_patch_config_8800d80x2(struct aic_sdio_dev *sdiodev);
+
+
+
+#endif
+

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic8800dc_compat.c

@@ -52,6 +52,7 @@ u32 syscfg_tbl_masked_8800dc[][3] = {
     {0x700010A0, (0x1 << 11), (0x1 << 11)},
     {0x70001034, ((0x1 << 20) | (0x7 << 26)), ((0x0 << 20) | (0x2 << 26))},
     {0x70001038, (0x1 << 8), (0x1 << 8)},
+    {0x70001084, (0x3 << 13), (0x0 << 13)},
     {0x70001094, (0x3 << 2), (0x0 << 2)},
     {0x700021D0, ((0x1 << 5) | (0x1 << 6)), ((0x1 << 5) | (0x1 << 6))},
     {0x70001000, ((0x1 << 0) | (0x1 << 20) | (0x1 << 22)),
@@ -69,6 +70,7 @@ u32 syscfg_tbl_masked_8800dc[][3] = {
     {0x700010A0, (0x1 << 11), (0x1 << 11)},
     {0x70001034, ((0x1 << 20) | (0x7 << 26)), ((0x0 << 20) | (0x2 << 26))},
     {0x70001038, (0x1 << 8), (0x1 << 8)},
+    {0x70001084, (0x3 << 13), (0x0 << 13)},
     {0x70001094, (0x3 << 2), (0x0 << 2)},
     {0x700021D0, ((0x1 << 5) | (0x1 << 6)), ((0x1 << 5) | (0x1 << 6))},
     {0x70001000, ((0x1 << 0) | (0x1 << 20) | (0x1 << 22)),
@@ -94,6 +96,7 @@ u32 syscfg_tbl_masked_8800dc_h[][3] = {
     {0x700010A0, (0x1 << 11), (0x1 << 11)},
     //{0x70001034, ((0x1 << 20) | (0x7 << 26)), ((0x0 << 20) | (0x2 << 26))},
     {0x70001038, (0x1 << 8), (0x1 << 8)},
+    {0x70001084, (0x3 << 13), (0x0 << 13)},
     {0x70001094, (0x3 << 2), (0x0 << 2)},
     {0x700021D0, ((0x1 << 5) | (0x1 << 6)), ((0x1 << 5) | (0x1 << 6))},
     #if defined(CONFIG_VRF_DCDC_MODE)
@@ -128,6 +131,9 @@ u32 patch_tbl_wifisetting_8800dc_u02[][2] =
 #else
 	{0x0124,0x01001E01}
 #endif
+#ifdef CONFIG_PRBREQ_REPORT
+	{0x0138, 0x00010a00}, //apm probe resp offload en
+#endif
 };
 
 
@@ -1323,7 +1329,7 @@ uint32_t agc_cfg_ram[] = {
     0x00000000
 };
 
-
+#if !defined(CONFIG_EXT_FEM_8800DCDW)
 uint32_t txgain_map[96] =  {
 #ifdef CONFIG_FPGA_VERIFICATION
     0x20c0c971,
@@ -1461,8 +1467,8 @@ uint32_t txgain_map[96] =  {
     0x00ffc88b,
     0x00ffc979,
     0x00ffc989,
-    0x00ffca7d,
-    0x00ffca88,
+    0x00ffcc4b,
+    0x00ffcc54,
     0x00ffcc5e,
     0x00ffcc69,
     0x00ffcc78,
@@ -1494,8 +1500,8 @@ uint32_t txgain_map[96] =  {
     0x00ffc88b,
     0x00ffc979,
     0x00ffc989,
-    0x00ffca7d,
-    0x00ffca88,
+    0x00ffcc4b,
+    0x00ffcc54,
     0x00ffcc5e,
     0x00ffcc69,
     0x00ffcc78,
@@ -1503,9 +1509,9 @@ uint32_t txgain_map[96] =  {
     0x00ffcd70,
     0x00ffcd80,
     0x00ffcd90,
-    0x00ffce80,
-    0x00ffce93,
-    0x00ffcf90,
+    0x00ffcf68,
+    0x00ffcf75,
+    0x00ffcf83,
     0x00ffc080,
     0x00ffc090,
     0x00ffc180,
@@ -1564,8 +1570,8 @@ const uint32_t txgain_map_h[96] =
     0xffc879, //8
     0xffc96b, //9
     0xffc979, //10
-    0xffca6b, //11
-    0xffca79, //12
+    0xffcc45, //11
+    0xffcc4d, //12
     0xffcc56, //13
     0xffcc60, //14
     0xffcc6b, //15
@@ -1597,15 +1603,15 @@ const uint32_t txgain_map_h[96] =
     0xffc879, //8
     0xffc96b, //9
     0xffc979, //10
-    0xffca6b, //11
-    0xffca79, //12
+    0xffcc45, //11
+    0xffcc4d, //12
     0xffcc56, //13
     0xffcc60, //14
     0xffcc6b, //15
     0xffcc79, //16
     0xffcd72, //17
-    0xffce60, //18
-    0xffce72, //19
+    0xffcf5b, //18
+    0xffcf66, //19
     0xffcf72, //20
     0xffcf80, //21
     0xffcf90, //22
@@ -1628,6 +1634,213 @@ const uint32_t txgain_map_h[96] =
     0xffc86b, //7
 };
 
+#else /* #ifdef CONFIG_EXT_FEM_8800DCDW */
+const uint32_t txgain_map_femkct[96] =
+{
+    //11b
+    0x00ffd780,//15
+    0x00ffd872,//16
+    0x00ffd880,//17
+    0x00ffd972,//18
+    0x00ffd980,//19
+    0x00ffda72,//20
+    0x00ffda80,//21
+    0x00ffdb72,//22
+    0x00ffdb80,//23
+    0x00ffdc72,//24
+    0x00ffdc80,//25
+    0x00ffdd72,//26
+    0x00ffdd80,//27
+    0x00ffde72,//28
+    0x00ffde80,//29
+    0x00ffdf72,//30
+    0x00ffd072,//-1
+    0x00ffd072,//0
+    0x00ffd080,//1
+    0x00ffd172,//2
+    0x00ffd180,//3
+    0x00ffd272,//4
+    0x00ffd280,//5
+    0x00ffd36d,//6
+    0x00ffd379,//7
+    0x00ffd46d,//8
+    0x00ffd479,//9
+    0x00ffd572,//10
+    0x00ffd580,//11
+    0x00ffd672,//12
+    0x00ffd680,//13
+    0x00ffd772,//14
+    //high
+    0x00ffc872,//11
+    0x00ffc880,//12
+    0x00ffc972,//13
+    0x00ffc980,//14
+    0x00ffca72,//15
+    0x00ffca80,//16
+    0x00ffcb72,//17
+    0x00ffcb80,//18
+    0x00ffcc72,//19
+    0x00ffcc80,//20
+    0x00ffcd72,//21
+    0x00ffcd80,//22
+    0x00ffce72,//23
+    0x00ffce80,//24
+    0x00ffcf72,//25
+    0x00ffcf80,//26
+    0x00ffc072,//-5
+    0x00ffc080,//-4
+    0x00ffc172,//-3
+    0x00ffc180,//-2
+    0x00ffc272,//-1
+    0x00ffc280,//0
+    0x00ffc372,//1
+    0x00ffc380,//2
+    0x00ffc472,//3
+    0x00ffc480,//4
+    0x00ffc572,//5
+    0x00ffc580,//6
+    0x00ffc672,//7
+    0x00ffc680,//8
+    0x00ffc772,//9
+    0x00ffc780,//10
+    //low
+    0x00ffc872,//11
+    0x00ffc880,//12
+    0x00ffc972,//13
+    0x00ffc980,//14
+    0x00ffca72,//15
+    0x00ffca80,//16
+    0x00ffcb72,//17
+    0x00ffcb80,//18
+    0x00ffcc72,//19
+    0x00ffcc80,//20
+    0x00ffcd72,//21
+    0x00ffcd80,//22
+    0x00ffce72,//23
+    0x00ffce80,//24
+    0x00ffcf72,//26
+    0x00ffcf80,//27
+    0x00ffc072,//-5
+    0x00ffc080,//-4
+    0x00ffc172,//-3
+    0x00ffc180,//-2
+    0x00ffc272,//-1
+    0x00ffc280,//0
+    0x00ffc372,//1
+    0x00ffc380,//2
+    0x00ffc472,//3
+    0x00ffc480,//4
+    0x00ffc572,//5
+    0x00ffc580,//6
+    0x00ffc672,//7
+    0x00ffc680,//8
+    0x00ffc772,//9
+    0x00ffc780,//10
+};
+
+const uint32_t txgain_map_femkct_h[96] =
+{
+    //11b
+    0x00ffd86c,//15
+    0x00ffd879,//16
+    0x00ffd96c,//17
+    0x00ffd979,//18
+    0x00ffd988,//19
+    0x00ffda6c,//20
+    0x00ffda79,//21
+    0x00ffdb6c,//22
+    0x00ffdb79,//23
+    0x00ffdc6c,//24
+    0x00ffdc79,//25
+    0x00ffdd6c,//26
+    0x00ffdd79,//27
+    0x00ffde6c,//28
+    0x00ffde79,//29
+    0x00ffdf6c,//30
+    0x00ffd06c,//-1
+    0x00ffd06c,//0
+    0x00ffd079,//1
+    0x00ffd16c,//2
+    0x00ffd179,//3
+    0x00ffd26c,//4
+    0x00ffd279,//5
+    0x00ffd372,//6
+    0x00ffd467,//7
+    0x00ffd472,//8
+    0x00ffd56c,//9
+    0x00ffd579,//10
+    0x00ffd66c,//11
+    0x00ffd679,//12
+    0x00ffd76c,//13
+    0x00ffd779,//14
+    //high
+    0x00ffc879,//11
+    0x00ffc96c,//12
+    0x00ffc979,//13
+    0x00ffca6c,//14
+    0x00ffca79,//15
+    0x00ffcb6c,//16
+    0x00ffcb79,//17
+    0x00ffcc6c,//18
+    0x00ffcc79,//19
+    0x00ffcc88,//20
+    0x00ffcd6c,//21
+    0x00ffcd79,//22
+    0x00ffce6c,//23
+    0x00ffce79,//24
+    0x00ffcf6c,//25
+    0x00ffcf79,//26
+    0x00ffc079,//-5
+    0x00ffc16c,//-4
+    0x00ffc179,//-3
+    0x00ffc26c,//-2
+    0x00ffc279,//-1
+    0x00ffc36c,//0
+    0x00ffc379,//1
+    0x00ffc46c,//2
+    0x00ffc479,//3
+    0x00ffc56c,//4
+    0x00ffc579,//5
+    0x00ffc66c,//6
+    0x00ffc679,//7
+    0x00ffc76c,//8
+    0x00ffc779,//9
+    0x00ffc86c,//10
+    //low
+    0x00ffc879,//11
+    0x00ffc96c,//12
+    0x00ffc979,//13
+    0x00ffca6c,//14
+    0x00ffca79,//15
+    0x00ffcb6c,//16
+    0x00ffcb79,//17
+    0x00ffcc6c,//18
+    0x00ffcc79,//19
+    0x00ffcc88,//20
+    0x00ffcd6c,//21
+    0x00ffcd79,//22
+    0x00ffce6c,//23
+    0x00ffce79,//24
+    0x00ffcf6c,//25
+    0x00ffcf79,//26
+    0x00ffc079,//-5
+    0x00ffc16c,//-4
+    0x00ffc179,//-3
+    0x00ffc26c,//-2
+    0x00ffc279,//-1
+    0x00ffc36c,//0
+    0x00ffc379,//1
+    0x00ffc46c,//2
+    0x00ffc479,//3
+    0x00ffc56c,//4
+    0x00ffc579,//5
+    0x00ffc66c,//6
+    0x00ffc679,//7
+    0x00ffc76c,//8
+    0x00ffc779,//9
+    0x00ffc86c,//10
+};
+#endif
 
 u32 jump_tbl[][2] =
 {
@@ -1689,10 +1902,61 @@ u32 patch_tbl_rf_func[][2] =
     {0x00110bf0, 0x00180001},
 };
 
+
+//adap test
+u32 adaptivity_patch_tbl_8800dc[][2] = {
+    {0x000C, 0x0000320A}, //linkloss_thd
+    {0x009C, 0x00000000}, //ac_param_conf
+    {0x0128, 0xF6140001}, //tx_adaptivity_en
+};
+//adap test
+
+
 static u8 chip_id = 0;
 #define CHIP_ID_H_MASK  0xC0
 #define IS_CHIP_ID_H()  ((chip_id & CHIP_ID_H_MASK) == CHIP_ID_H_MASK)
 
+//Crystal provided by CPU (start)
+int set_bbpll_config(struct aic_sdio_dev *rwnx_hw){
+//    {0x40505010, 0x7C301010},//bbpll
+	int ret = 0;
+	struct dbg_mem_read_cfm rd_mem_addr_cfm;
+
+	//Read crystal provided by CPU or not.
+    ret = rwnx_send_dbg_mem_read_req(rwnx_hw, 0x40500148, &rd_mem_addr_cfm);
+    if (ret) {
+		AICWFDBG(LOGERROR, "%x rd fail: %d\n", 0x40500148, ret);
+        return -1;
+    }
+
+	AICWFDBG(LOGDEBUG, "%s rd_mem_addr_cfm.memdata:%x \r\n", __func__, rd_mem_addr_cfm.memdata);
+
+	if(!(rd_mem_addr_cfm.memdata & 0x01)){
+		AICWFDBG(LOGINFO, "%s Crystal not provided by CPU \r\n", __func__);
+		return 0;
+	}else{
+		AICWFDBG(LOGINFO, "%s Crystal provided by CPU \r\n", __func__);
+		//Read 0x40505010 value to check bbpll set or not.
+		ret = rwnx_send_dbg_mem_read_req(rwnx_hw, 0x40505010, &rd_mem_addr_cfm);
+		if(ret < 0){
+			AICWFDBG(LOGERROR, "%s error ret_val:%d\r\n", __func__, ret);
+			return -1;
+		}
+
+		if((rd_mem_addr_cfm.memdata >> 29) == 3){
+			AICWFDBG(LOGERROR, "%s Not need to set \r\n", __func__);
+			return 0;
+		}else{
+			rd_mem_addr_cfm.memdata |= ((0x1 << 29) | (0x1 << 30));
+			rd_mem_addr_cfm.memdata &= (~(0x1 << 31));
+			rwnx_send_dbg_mem_write_req(rwnx_hw, 0x40505010, rd_mem_addr_cfm.memdata);
+		}
+	}
+	return 0;
+}
+//Crystal provided by CPU (end)
+
+
 void system_config_8800dc(struct aic_sdio_dev *rwnx_hw)
 {
     int syscfg_num;
@@ -1724,6 +1988,14 @@ void system_config_8800dc(struct aic_sdio_dev *rwnx_hw)
     //printk("%x=%x\n", rd_mem_addr_cfm.memaddr, rd_mem_addr_cfm.memdata);
 	AICWFDBG(LOGINFO, "chip_id=%x, chip_sub_id=%x!!\n", chip_id, chip_sub_id);
 
+	//Crystal provided by CPU (start)
+	ret = set_bbpll_config(rwnx_hw);
+    if (ret) {
+		AICWFDBG(LOGERROR, "set_bbpll_config fail: %d\n", ret);
+        return;
+    }
+	//Crystal provided by CPU (end)
+
 
 	ret = rwnx_send_dbg_mem_read_req(rwnx_hw, 0x40500010, &rd_mem_addr_cfm);
 	AICWFDBG(LOGDEBUG, "[0x40500010]=%x\n", rd_mem_addr_cfm.memdata);
@@ -1816,6 +2088,7 @@ void system_config_8800dc(struct aic_sdio_dev *rwnx_hw)
 
 }
 
+extern int adap_test;
 
 void aicwf_patch_config_8800dc(struct aic_sdio_dev *rwnx_hw)
 {
@@ -1838,6 +2111,11 @@ void aicwf_patch_config_8800dc(struct aic_sdio_dev *rwnx_hw)
         u32 jump_tbl_size = 0;
         u32 patch_tbl_func_num = 0;
 
+	//adap test
+	int adap_patch_num = 0;
+	//adap test
+
+
         array2_tbl_t jump_tbl_base = NULL;
         array2_tbl_t patch_tbl_func_base = NULL;
 		array2_tbl_t patch_tbl_wifisetting_8800dc_base = NULL;
@@ -1895,6 +2173,19 @@ void aicwf_patch_config_8800dc(struct aic_sdio_dev *rwnx_hw)
 			}
 		}
 
+//adap test
+		if(adap_test){
+            AICWFDBG(LOGINFO, "%s for adaptivity test \r\n", __func__);
+			adap_patch_num = sizeof(adaptivity_patch_tbl_8800dc)/sizeof(u32)/2;
+			for(cnt = 0; cnt < adap_patch_num; cnt++)
+			{
+				if((ret = rwnx_send_dbg_mem_write_req(rwnx_hw, wifisetting_cfg_addr + adaptivity_patch_tbl_8800dc[cnt][0], adaptivity_patch_tbl_8800dc[cnt][1]))) {
+					AICWFDBG(LOGERROR, "%x write fail\n", wifisetting_cfg_addr + adaptivity_patch_tbl_8800dc[cnt][0]);
+				}
+			}
+		}
+//adap test
+
         if (ldpc_cfg_size > 512) {// > 0.5KB data
             for (i = 0; i < (ldpc_cfg_size - 512); i += 512) {//each time write 0.5KB
                 ret = rwnx_send_dbg_mem_block_write_req(rwnx_hw, ldpc_cfg_addr + i, 512, ldpc_cfg_ram + i / 4);
@@ -1931,11 +2222,21 @@ void aicwf_patch_config_8800dc(struct aic_sdio_dev *rwnx_hw)
 
         #if !defined(CONFIG_FPGA_VERIFICATION)
         if ((IS_CHIP_ID_H())) {
+            #if defined(CONFIG_EXT_FEM_8800DCDW)
+            txgain_cfg_size = sizeof(txgain_map_femkct_h);
+            txgain_cfg_array = (u32 *)txgain_map_femkct_h;
+            #else
             txgain_cfg_size = sizeof(txgain_map_h);
             txgain_cfg_array = (u32 *)txgain_map_h;
+            #endif
         } else {
+            #if defined(CONFIG_EXT_FEM_8800DCDW)
+            txgain_cfg_size = sizeof(txgain_map_femkct);
+            txgain_cfg_array = (u32 *)txgain_map_femkct;
+            #else
             txgain_cfg_size = sizeof(txgain_map);
             txgain_cfg_array = (u32 *)txgain_map;
+            #endif
         }
         ret = rwnx_send_dbg_mem_block_write_req(rwnx_hw, txgain_cfg_addr, txgain_cfg_size, txgain_cfg_array);
         if (ret) {
@@ -2223,4 +2524,116 @@ int aicwf_dpd_result_write_8800dc(void *buf, int buf_len)
 #endif /* !CONFIG_FORCE_DPD_CALIB */
 #endif
 
+#ifdef CONFIG_LOFT_CALIB
+int aicwf_loft_calib_8800dc(struct aic_sdio_dev *sdiodev, rf_misc_ram_lite_t *loft_res)
+{
+    int ret = 0;
+    uint32_t fw_addr, boot_type;
+    int valid_flag;
 
+    printk("%s\n", __func__);
+
+    ret = aicwf_misc_ram_valid_check_8800dc(sdiodev, &valid_flag);
+    if (ret) {
+        AICWFDBG(LOGINFO, "misc ram check fail: %d\n", ret);
+        return ret;
+    }
+    if (valid_flag) {
+        AICWFDBG(LOGINFO, "misc ram valid, skip calib process\n");
+        return ret;
+    }
+    ret = aicwf_plat_calib_load_8800dc(sdiodev);
+    if (ret) {
+        AICWFDBG(LOGINFO, "load calib bin fail: %d\n", ret);
+        return ret;
+    }
+    /* fw start */
+    fw_addr = 0x00130009;
+    boot_type = HOST_START_APP_FNCALL;
+    AICWFDBG(LOGINFO, "Start app: %08x, %d\n", fw_addr, boot_type);
+    ret = rwnx_send_dbg_start_app_req(sdiodev, fw_addr, boot_type, NULL);
+    if (ret) {
+        AICWFDBG(LOGINFO, "start app fail: %d\n", ret);
+        return ret;
+    }
+    { // read loft res
+        const uint32_t cfg_base = 0x10164;
+        struct dbg_mem_read_cfm cfm;
+        uint32_t misc_ram_addr;
+        uint32_t ram_base_addr, ram_word_cnt;
+        int i;
+        ret = rwnx_send_dbg_mem_read_req(sdiodev, cfg_base + 0x14, &cfm);
+        if (ret) {
+            AICWFDBG(LOGERROR, "rf misc ram[0x%x] rd fail: %d\n", cfg_base + 0x14, ret);
+            return ret;
+        }
+        misc_ram_addr = cfm.memdata;
+        // bit_mask
+        ram_base_addr = misc_ram_addr + offsetof(rf_misc_ram_t, bit_mask);
+        ram_word_cnt = (MEMBER_SIZE(rf_misc_ram_t, bit_mask) + MEMBER_SIZE(rf_misc_ram_t, reserved)) / 4;
+        for (i = 0; i < ram_word_cnt; i++) {
+            ret = rwnx_send_dbg_mem_read_req(sdiodev, ram_base_addr + i * 4, &cfm);
+            if (ret) {
+                AICWFDBG(LOGERROR, "bit_mask[0x%x] rd fail: %d\n",  ram_base_addr + i * 4, ret);
+                return ret;
+            }
+            loft_res->bit_mask[i] = cfm.memdata;
+        }
+        // loft_res
+        ram_base_addr = misc_ram_addr + offsetof(rf_misc_ram_t, loft_res);
+        ram_word_cnt = MEMBER_SIZE(rf_misc_ram_t, loft_res) / 4;
+        for (i = 0; i < ram_word_cnt; i++) {
+            ret = rwnx_send_dbg_mem_read_req(sdiodev, ram_base_addr + i * 4, &cfm);
+            if (ret) {
+                AICWFDBG(LOGERROR, "loft_res[0x%x] rd fail: %d\n",  ram_base_addr + i * 4, ret);
+                return ret;
+            }
+            loft_res->loft_res[i] = cfm.memdata;
+        }
+    }
+    return ret;
+}
+
+int aicwf_loft_result_apply_8800dc(struct aic_sdio_dev *sdiodev, rf_misc_ram_lite_t *loft_res)
+{
+    int ret = 0;
+    uint32_t cfg_base = 0x10164;
+    struct dbg_mem_read_cfm cfm;
+    uint32_t misc_ram_addr;
+    uint32_t ram_base_addr, ram_byte_cnt;
+    AICWFDBG(LOGINFO, "bit_mask[1]=%x\n", loft_res->bit_mask[1]);
+    if (loft_res->bit_mask[1] == 0) {
+        AICWFDBG(LOGERROR, "void loft_res, bypass it.\n");
+        return 0;
+    }
+    if (testmode == FW_RFTEST_MODE) {
+        cfg_base = RAM_LMAC_FW_ADDR + 0x0164;
+    }
+    if ((ret = rwnx_send_dbg_mem_read_req(sdiodev, cfg_base + 0x14, &cfm))) {
+        AICWFDBG(LOGERROR, "rf misc ram[0x%x] rd fail: %d\n", cfg_base + 0x14, ret);
+        return ret;
+    }
+    misc_ram_addr = cfm.memdata;
+    AICWFDBG(LOGINFO, "misc_ram_addr: %x\n", misc_ram_addr);
+    /* Copy loft_res on the Embedded side */
+    // bit_mask
+    AICWFDBG(LOGINFO, "bit_mask[0]=%x\n", loft_res->bit_mask[0]);
+    ram_base_addr = misc_ram_addr + offsetof(rf_misc_ram_t, bit_mask);
+    ram_byte_cnt = MEMBER_SIZE(rf_misc_ram_t, bit_mask) + MEMBER_SIZE(rf_misc_ram_t, reserved);
+    ret = rwnx_send_dbg_mem_block_write_req(sdiodev, ram_base_addr, ram_byte_cnt, (u32 *)&loft_res->bit_mask[0]);
+    if (ret) {
+        AICWFDBG(LOGERROR, "bit_mask wr fail: %x, ret:%d\r\n", ram_base_addr, ret);
+        return ret;
+    }
+    // loft_res
+    AICWFDBG(LOGINFO, "loft_res[0]=%x\n", loft_res->loft_res[0]);
+    ram_base_addr = misc_ram_addr + offsetof(rf_misc_ram_t, loft_res);
+    ram_byte_cnt = MEMBER_SIZE(rf_misc_ram_t, loft_res);
+    ret = rwnx_send_dbg_mem_block_write_req(sdiodev, ram_base_addr, ram_byte_cnt, (u32 *)&loft_res->loft_res[0]);
+    if (ret) {
+        AICWFDBG(LOGERROR, "loft_res wr fail: %x, ret:%d\r\n", ram_base_addr, ret);
+        return ret;
+    }
+    return ret;
+}
+#endif

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic8800dc_compat.h

@@ -30,6 +30,10 @@ int aicwf_dpd_result_load_8800dc(struct aic_sdio_dev *sdiodev, rf_misc_ram_lite_
 int aicwf_dpd_result_write_8800dc(void *buf, int buf_len);
 #endif/* !CONFIG_FORCE_DPD_CALIB */
 #endif
+#ifdef CONFIG_LOFT_CALIB
+int aicwf_loft_calib_8800dc(struct aic_sdio_dev *sdiodev, rf_misc_ram_lite_t *loft_res);
+int aicwf_loft_result_apply_8800dc(struct aic_sdio_dev *sdiodev, rf_misc_ram_lite_t *loft_res);
+#endif
 
 #endif
 

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic_bsp_driver.c

@@ -27,6 +27,7 @@
 #include "md5.h"
 #include "aic8800dc_compat.h"
 #include "aic8800d80_compat.h"
+#include "aic8800d80x2_compat.h"
 #include "aicwf_firmware_array.h"
 #define FW_PATH_MAX 200
 
@@ -242,9 +243,12 @@ void rwnx_cmd_mgr_init(struct rwnx_cmd_mgr *cmd_mgr)
 
 void rwnx_cmd_mgr_deinit(struct rwnx_cmd_mgr *cmd_mgr)
 {
-	cmd_mgr->print(cmd_mgr);
-	cmd_mgr->drain(cmd_mgr);
-	cmd_mgr->print(cmd_mgr);
+	if(cmd_mgr->print)
+		cmd_mgr->print(cmd_mgr);
+	if(cmd_mgr->drain)
+		cmd_mgr->drain(cmd_mgr);
+	if(cmd_mgr->print)
+		cmd_mgr->print(cmd_mgr);
 	memset(cmd_mgr, 0, sizeof(*cmd_mgr));
 }
 
@@ -262,7 +266,7 @@ void rwnx_set_cmd_tx(void *dev, struct lmac_msg *msg, uint len)
     if (sdiodev->chipid == PRODUCT_ID_AIC8801 || sdiodev->chipid == PRODUCT_ID_AIC8800DC ||
         sdiodev->chipid == PRODUCT_ID_AIC8800DW)
         buffer[3] = 0x0;
-    else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80)
+    else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80 || sdiodev->chipid == PRODUCT_ID_AIC8800D80X2)
 	    buffer[3] = crc8_ponl_107(&buffer[0], 3); // crc8
 	index += 4;
 	//there is a dummy word
@@ -984,7 +988,7 @@ int aicwf_plat_rftest_load_8800dc(struct aic_sdio_dev *sdiodev)
     return ret;
 }
 
-#ifdef CONFIG_DPD
+#if defined(CONFIG_DPD) || defined(CONFIG_LOFT_CALIB)
 int aicwf_misc_ram_valid_check_8800dc(struct aic_sdio_dev *sdiodev, int *valid_out)
 {
     int ret = 0;
@@ -998,7 +1002,7 @@ int aicwf_misc_ram_valid_check_8800dc(struct aic_sdio_dev *sdiodev, int *valid_o
         *valid_out = 0;
     }
     if (testmode == FW_RFTEST_MODE) {
-		
+
 	    uint32_t vect1 = 0;
 	    uint32_t vect2 = 0;
 	    cfg_base = RAM_LMAC_FW_ADDR + 0x0004;
@@ -1061,19 +1065,21 @@ int aicwf_plat_calib_load_8800dc(struct aic_sdio_dev *sdiodev)
     if (chip_sub_id == 1) {
         ret = rwnx_plat_bin_fw_upload_android(sdiodev, ROM_FMAC_CALIB_ADDR, RWNX_MAC_CALIB_NAME_8800DC_U02);
         if (ret) {
-            AICWFDBG(LOGINFO, "load rftest bin fail: %d\n", ret);
+            AICWFDBG(LOGINFO, "load calib bin fail: %d\n", ret);
             return ret;
         }
     } else if (chip_sub_id == 2) {
         ret = rwnx_plat_bin_fw_upload_android(sdiodev, ROM_FMAC_CALIB_ADDR, RWNX_MAC_CALIB_NAME_8800DC_H_U02);
         if (ret) {
-            AICWFDBG(LOGINFO, "load rftest bin fail: %d\n", ret);
+            AICWFDBG(LOGINFO, "load calib bin fail: %d\n", ret);
             return ret;
         }
     }
     return ret;
 }
+#endif
 
+#ifdef CONFIG_DPD
 #ifndef CONFIG_FORCE_DPD_CALIB
 int is_file_exist(char* name)
 {
@@ -1111,6 +1117,11 @@ rf_misc_ram_lite_t dpd_res = {{0},};
 EXPORT_SYMBOL(dpd_res);
 #endif
 
+#ifdef CONFIG_LOFT_CALIB
+rf_misc_ram_lite_t loft_res_local = {{0},};
+EXPORT_SYMBOL(loft_res_local);
+#endif
+
 static int rwnx_plat_patch_load(struct aic_sdio_dev *sdiodev)
 {
 	int ret = 0;
@@ -1168,6 +1179,15 @@ static int rwnx_plat_patch_load(struct aic_sdio_dev *sdiodev)
                 }
                 #endif
                 else
+                #elif defined(CONFIG_LOFT_CALIB)
+                if (1) {
+                    AICWFDBG(LOGINFO, "loft calib\n");
+                    ret = aicwf_loft_calib_8800dc(sdiodev, &loft_res_local);
+                    if (ret) {
+                        AICWFDBG(LOGINFO, "loft calib fail: %d\n", ret);
+                        return ret;
+                    }
+                } else
                 #endif
                 {
                     ret = aicwf_misc_ram_init_8800dc(sdiodev);
@@ -1193,8 +1213,23 @@ static int rwnx_plat_patch_load(struct aic_sdio_dev *sdiodev)
                         return ret;
                     }
                 }
-                #endif
-                #endif
+                #endif/*CONFIG_FORCE_DPD_CALIB*/
+                #elif defined(CONFIG_LOFT_CALIB)
+                {
+                    AICWFDBG(LOGINFO, "patch load\n");
+                    ret = aicwf_plat_patch_load_8800dc(sdiodev);
+                    if (ret) {
+                        AICWFDBG(LOGINFO, "load patch bin fail: %d\n", ret);
+                        return ret;
+                    }
+                    AICWFDBG(LOGINFO, "loft calib\n");
+                    ret = aicwf_loft_calib_8800dc(sdiodev, &loft_res_local);
+                    if (ret) {
+                        AICWFDBG(LOGINFO, "loft calib fail: %d\n", ret);
+                        return ret;
+                    }
+                }
+                #endif/*CONFIG_DPD*/
                 ret = aicwf_plat_rftest_load_8800dc(sdiodev);
                 if (ret) {
                     AICWFDBG(LOGINFO, "load rftest bin fail: %d\n", ret);
@@ -1360,14 +1395,89 @@ err:
 }
 int aicbt_patch_info_unpack(struct aicbt_patch_info_t *patch_info, struct aicbt_patch_table *head_t)
 {
+    uint8_t *patch_info_array = (uint8_t*)patch_info;
+    int base_len = 0;
+    int memcpy_len = 0;
+    
     if (AICBT_PT_INF == head_t->type) {
-        patch_info->info_len = head_t->len;
-        if(patch_info->info_len == 0)
+        base_len = ((offsetof(struct aicbt_patch_info_t,  ext_patch_nb_addr) - offsetof(struct aicbt_patch_info_t,  adid_addrinf) )/sizeof(uint32_t))/2;
+        AICWFDBG(LOGDEBUG, "%s head_t->len:%d base_len:%d \r\n", __func__, head_t->len, base_len);
+
+        if (head_t->len > base_len){
+            patch_info->info_len = base_len;
+            memcpy_len = patch_info->info_len + 1;//include ext patch nb     
+        } else{
+            patch_info->info_len = head_t->len;
+            memcpy_len = patch_info->info_len;
+        }
+	head_t->len = patch_info->info_len;
+        AICWFDBG(LOGDEBUG, "%s memcpy_len:%d \r\n", __func__, memcpy_len);   
+
+        if (patch_info->info_len == 0)
             return 0;
-        memcpy(&patch_info->adid_addrinf, head_t->data, patch_info->info_len * sizeof(uint32_t) * 2);
+       
+        memcpy(((patch_info_array) + sizeof(patch_info->info_len)), 
+            head_t->data, 
+            memcpy_len * sizeof(uint32_t) * 2);
+        AICWFDBG(LOGDEBUG, "%s adid_addrinf:%x addr_adid:%x \r\n", __func__, 
+            ((struct aicbt_patch_info_t *)patch_info_array)->adid_addrinf,
+            ((struct aicbt_patch_info_t *)patch_info_array)->addr_adid);
+
+        if (patch_info->ext_patch_nb > 0){
+            int index = 0;
+            patch_info->ext_patch_param = (uint32_t *)(head_t->data + ((memcpy_len) * 2));
+            
+            for(index = 0; index < patch_info->ext_patch_nb; index++){
+                AICWFDBG(LOGDEBUG, "%s id:%x addr:%x \r\n", __func__, 
+                    *(patch_info->ext_patch_param + (index * 2)),
+                    *(patch_info->ext_patch_param + (index * 2) + 1));
+            }
+        }
+
     }
     return 0;
 }
+
+int aicbt_ext_patch_data_load(struct aic_sdio_dev *sdiodev, struct aicbt_patch_info_t *patch_info)
+{
+    int ret = 0;
+    uint32_t ext_patch_nb = patch_info->ext_patch_nb;
+    char ext_patch_file_name[50];
+    int index = 0;
+    uint32_t id = 0;
+    uint32_t addr = 0;
+
+    
+    if (ext_patch_nb > 0){
+        if (sdiodev->chipid == PRODUCT_ID_AIC8800DC) {
+			AICWFDBG(LOGDEBUG, "[0x40506004]: 0x04318000\n");
+			ret = rwnx_send_dbg_mem_write_req(sdiodev, 0x40506004, 0x04318000);
+			AICWFDBG(LOGDEBUG, "[0x40506004]: 0x04338000\n");
+			ret = rwnx_send_dbg_mem_write_req(sdiodev, 0x40506004, 0x04338000);
+        } else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80X2) {
+			AICWFDBG(LOGDEBUG, "[0x40580000]: 0x00040220\n");
+			ret = rwnx_send_dbg_mem_write_req(sdiodev, 0x40580000, 0x00040220);
+        }
+        for (index = 0; index < patch_info->ext_patch_nb; index++){
+            id = *(patch_info->ext_patch_param + (index * 2));
+            addr = *(patch_info->ext_patch_param + (index * 2) + 1); 
+            memset(ext_patch_file_name, 0, sizeof(ext_patch_file_name));
+            sprintf(ext_patch_file_name,"%s%d.bin",
+                aicbsp_firmware_list[aicbsp_info.cpmode].bt_ext_patch,
+                id);
+            AICWFDBG(LOGDEBUG, "%s ext_patch_file_name:%s ext_patch_id:%x ext_patch_addr:%x \r\n",
+                __func__,ext_patch_file_name, id, addr);
+            
+            if (rwnx_plat_bin_fw_upload_android(sdiodev, addr, ext_patch_file_name)) {
+                ret = -1;
+                break;
+            }
+        }
+    }
+    return ret;
+}
+
+
 int aicbt_patch_trap_data_load(struct aic_sdio_dev *sdiodev, struct aicbt_patch_table *head)
 {
 	struct aicbt_patch_info_t patch_info = {
@@ -1380,6 +1490,8 @@ int aicbt_patch_trap_data_load(struct aic_sdio_dev *sdiodev, struct aicbt_patch_
         .reset_val         = 0,
         .adid_flag_addr    = 0,
         .adid_flag         = 0,
+        .ext_patch_nb_addr = 0,
+        .ext_patch_nb      = 0,
 	};
     if(head == NULL){
         return -1;
@@ -1420,12 +1532,20 @@ int aicbt_patch_trap_data_load(struct aic_sdio_dev *sdiodev, struct aicbt_patch_
             printk("%s, aicbt_patch_info_unpack fail\n", __func__);
             return -1;
         }
+	} else if(sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
+        aicbt_patch_info_unpack(&patch_info, head);
+        if(patch_info.info_len == 0) {
+            printk("%s, aicbt_patch_info_unpack fail\n", __func__);
+            return -1;
+        }
 	}
 
 	if (rwnx_plat_bin_fw_upload_android(sdiodev, patch_info.addr_adid, aicbsp_firmware_list[aicbsp_info.cpmode].bt_adid))
 		return -1;
 	if (rwnx_plat_bin_fw_upload_android(sdiodev, patch_info.addr_patch, aicbsp_firmware_list[aicbsp_info.cpmode].bt_patch))
 		return -1;
+	if (aicbt_ext_patch_data_load(sdiodev, &patch_info))
+		return -1;
 	return 0;
 
 }
@@ -1462,7 +1582,16 @@ static struct aicbt_info_t aicbt_info[]={
         .uart_flowctrl = AICBT_UART_FC_DEFAULT,
         .lpm_enable    = AICBT_LPM_ENABLE_DEFAULT,
         .txpwr_lvl     = AICBT_TXPWR_LVL_DEFAULT_8800d80,
-    }//PRODUCT_ID_AIC8800D80
+    },//PRODUCT_ID_AIC8800D80
+    {
+        .btmode        = AICBT_BTMODE_DEFAULT_8800d80x2,
+        .btport        = AICBT_BTPORT_DEFAULT,
+        .uart_baud     = AICBT_UART_BAUD_DEFAULT,
+        .uart_flowctrl = AICBT_UART_FC_DEFAULT,
+        .lpm_enable    = AICBT_LPM_ENABLE_DEFAULT,
+        .txpwr_lvl     = AICBT_TXPWR_LVL_DEFAULT_8800d80x2,
+    }//PRODUCT_ID_AIC8800D80x2
+
 };
 
 
@@ -1738,6 +1867,12 @@ int aicwifi_init(struct aic_sdio_dev *sdiodev)
 			printk("download wifi fw fail\n");
 			return -1;
 		}
+		if (testmode == FW_NORMAL_MODE) {
+			if (rwnx_plat_bin_fw_upload_android(sdiodev, RAM_FMAC_FW_PATCH_ADDR, RAM_FMAC_FW_PATCH_NAME)) {
+				printk("download wifi fw patch fail\n");
+				return -1;
+			}
+		}
 
 		if (aicwifi_patch_config(sdiodev)) {
 			printk("aicwifi_patch_config fail\n");
@@ -1792,9 +1927,24 @@ int aicwifi_init(struct aic_sdio_dev *sdiodev)
 			printk("8800d80 wifi start fail\n");
 			return -1;
 		}
+	}else if(sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
+		if (rwnx_plat_bin_fw_upload_android(sdiodev, RAM_FMAC_FW_ADDR, aicbsp_firmware_list[aicbsp_info.cpmode].wl_fw)) {
+			printk("8800d80x2 download wifi fw fail\n");
+			return -1;
+		}
+
+		if (aicwifi_patch_config_8800d80x2(sdiodev)) {
+			printk("aicwifi_patch_config_8800d80x2 fail\n");
+			return -1;
+		}
+
+		if (aicwifi_start_from_bootrom(sdiodev)) {
+			printk("8800d80x2 wifi start fail\n");
+			return -1;
+		}
 	}
 
-#ifdef CONFIG_GPIO_WAKEUP
+#if (defined(CONFIG_GPIO_WAKEUP) || defined(CONFIG_SDIO_PWRCTRL))
 	if (aicwf_sdio_writeb(sdiodev, sdiodev->sdio_reg.wakeup_reg, 4)) {
 		sdio_err("reg:%d write failed!\n", sdiodev->sdio_reg.wakeup_reg);
 		return -1;
@@ -1920,16 +2070,34 @@ int aicbsp_driver_fw_init(struct aic_sdio_dev *sdiodev)
 		if (rwnx_send_dbg_mem_read_req(sdiodev, mem_addr, &rd_mem_addr_cfm))
 			return -1;
 
-		aicbsp_info.chip_rev = (u8)(rd_mem_addr_cfm.memdata >> 16);
+		aicbsp_info.chip_rev = (u8)((rd_mem_addr_cfm.memdata >> 16) & 0x3F);
+		is_chip_id_h = (u8)(((rd_mem_addr_cfm.memdata >> 16) & 0xC0) == 0xC0);
 		btenable = 1;
-
-		if (aicbsp_info.chip_rev == CHIP_REV_U01)
-            aicbsp_firmware_list = fw_8800d80_u01;
-        if (aicbsp_info.chip_rev == CHIP_REV_U02 || aicbsp_info.chip_rev == CHIP_REV_U03)
-            aicbsp_firmware_list = fw_8800d80_u02;
+		if (is_chip_id_h) {
+			AICWFDBG(LOGINFO, "IS_CHIP_ID_H \n");
+			aicbsp_firmware_list = fw_8800d80_h_u02;
+		} else {
+			if (aicbsp_info.chip_rev == CHIP_REV_U01)
+				aicbsp_firmware_list = fw_8800d80_u01;
+			if (aicbsp_info.chip_rev == CHIP_REV_U02 || aicbsp_info.chip_rev == CHIP_REV_U03)
+				aicbsp_firmware_list = fw_8800d80_u02;
+		}
         if (aicbsp_system_config_8800d80(sdiodev))
             return -1;
 	}
+	else if(sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
+        btenable = 1;
+		if (rwnx_send_dbg_mem_read_req(sdiodev, mem_addr, &rd_mem_addr_cfm))
+			return -1;
+
+		aicbsp_info.chip_rev = (u8)((rd_mem_addr_cfm.memdata >> 16) & 0x3F);
+			if (aicbsp_info.chip_rev >= (CHIP_REV_U04 + 8))
+				aicbsp_firmware_list = fw_8800d80x2;
+			else{
+					pr_err("aicbsp: %s, unsupport chip rev: %d\n", __func__, aicbsp_info.chip_rev);
+					return -1;
+			}
+	}
 
 	AICWFDBG(LOGINFO, "aicbsp: %s, chip rev: %d\n", __func__, aicbsp_info.chip_rev);
 
@@ -1955,7 +2123,7 @@ int aicbsp_get_feature(struct aicbsp_feature_t *feature, char *fw_path)
         aicbsp_sdiodev->chipid == PRODUCT_ID_AIC8800DC ||
         aicbsp_sdiodev->chipid == PRODUCT_ID_AIC8800DW){
 	    feature->sdio_clock = FEATURE_SDIO_CLOCK;
-	}else if (aicbsp_sdiodev->chipid == PRODUCT_ID_AIC8800D80){
+	}else if (aicbsp_sdiodev->chipid == PRODUCT_ID_AIC8800D80 || aicbsp_sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
         feature->sdio_clock = FEATURE_SDIO_CLOCK_V3;
 	}
 	feature->sdio_phase = FEATURE_SDIO_PHASE;
@@ -1965,9 +2133,11 @@ int aicbsp_get_feature(struct aicbsp_feature_t *feature, char *fw_path)
 	if(fw_path != NULL){
 		sprintf(fw_path,"%s", AICBSP_FW_PATH);
 	}
+    
     sdio_dbg("%s, set FEATURE_SDIO_CLOCK %d MHz\n", __func__, feature->sdio_clock/1000000);
 	return 0;
 }
+
 EXPORT_SYMBOL_GPL(aicbsp_get_feature);
 
 #ifdef CONFIG_RESV_MEM_SUPPORT

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic_bsp_driver.h

@@ -16,7 +16,7 @@
 #include <linux/module.h>
 #include "aic_bsp_export.h"
 
-#define RWNX_80211_CMD_TIMEOUT_MS    3000//500//300
+#define RWNX_80211_CMD_TIMEOUT_MS    6000//500//300
 
 #define RWNX_CMD_FLAG_NONBLOCK      BIT(0)
 #define RWNX_CMD_FLAG_REQ_CFM       BIT(1)
@@ -310,7 +310,7 @@ struct dbg_start_app_cfm {
 
 int aicwf_plat_patch_load_8800dc(struct aic_sdio_dev *sdiodev);
 int aicwf_plat_rftest_load_8800dc(struct aic_sdio_dev *sdiodev);
-#ifdef CONFIG_DPD
+#if defined(CONFIG_DPD) || defined(CONFIG_LOFT_CALIB)
 int aicwf_misc_ram_valid_check_8800dc(struct aic_sdio_dev *sdiodev, int *valid_out);
 int aicwf_plat_calib_load_8800dc(struct aic_sdio_dev *sdiodev);
 #endif
@@ -338,12 +338,12 @@ int is_file_exist(char* name);
 #endif
 int aicbsp_resv_mem_init(void);
 int aicbsp_resv_mem_deinit(void);
-extern char* aic_default_fw_path;
 
-#define AICBSP_FW_PATH              aic_default_fw_path
+#define AICBSP_FW_PATH              CONFIG_AIC_FW_PATH
 #define AICBSP_FW_PATH_MAX          200
 
 #define RAM_FMAC_FW_ADDR                    0x00120000
+#define RAM_FMAC_FW_PATCH_ADDR              0x00190000
 #define FW_RAM_ADID_BASE_ADDR               0x00161928
 #define FW_RAM_ADID_BASE_ADDR_U03           0x00161928
 #define FW_RAM_PATCH_BASE_ADDR              0x00100000
@@ -370,12 +370,19 @@ extern char* aic_default_fw_path;
 #define ROM_FMAC_FW_ADDR               0x00010000
 #define ROM_FMAC_PATCH_ADDR            0x00180000
 
-#define RWNX_MAC_CALIB_BASE_NAME_8800DC        "fmacfw_calib_8800dc"
+#define RAM_FMAC_FW_PATCH_NAME      			"fmacfw_patch.bin"
+#define RWNX_MAC_CALIB_BASE_NAME_8800DC         "fmacfw_calib_8800dc"
 #define RWNX_MAC_CALIB_NAME_8800DC_U02          RWNX_MAC_CALIB_BASE_NAME_8800DC"_u02.bin"
+#ifdef CONFIG_SDIO_BT
+#define RWNX_MAC_CALIB_NAME_8800DC_H_U02        RWNX_MAC_CALIB_BASE_NAME_8800DC"_hbt_u02.bin"
+#else
 #define RWNX_MAC_CALIB_NAME_8800DC_H_U02        RWNX_MAC_CALIB_BASE_NAME_8800DC"_h_u02.bin"
+#endif
 
-#ifdef CONFIG_DPD
+#if defined(CONFIG_DPD) || defined(CONFIG_LOFT_CALIB)
 #define ROM_FMAC_CALIB_ADDR            0x00130000
+#endif
+#ifdef CONFIG_DPD
 #ifndef CONFIG_FORCE_DPD_CALIB
 #define FW_DPDRESULT_NAME_8800DC        "aic_dpdresult_lite_8800dc.bin"
 #endif
@@ -390,13 +397,21 @@ extern char* aic_default_fw_path;
 #define RWNX_MAC_PATCH_BASE_NAME_8800DC        "fmacfw_patch_8800dc"
 #define RWNX_MAC_PATCH_NAME2_8800DC RWNX_MAC_PATCH_BASE_NAME_8800DC".bin"
 #define RWNX_MAC_PATCH_NAME2_8800DC_U02 RWNX_MAC_PATCH_BASE_NAME_8800DC"_u02.bin"
+#ifdef CONFIG_SDIO_BT
+#define RWNX_MAC_PATCH_NAME2_8800DC_H_U02 RWNX_MAC_PATCH_BASE_NAME_8800DC"_hbt_u02.bin"
+#else
 #define RWNX_MAC_PATCH_NAME2_8800DC_H_U02 RWNX_MAC_PATCH_BASE_NAME_8800DC"_h_u02.bin"
 #endif
+#endif
 
 #define RWNX_MAC_PATCH_TABLE_NAME_8800DC "fmacfw_patch_tbl_8800dc"
 #define RWNX_MAC_PATCH_TABLE_8800DC RWNX_MAC_PATCH_TABLE_NAME_8800DC ".bin"
 #define RWNX_MAC_PATCH_TABLE_8800DC_U02 RWNX_MAC_PATCH_TABLE_NAME_8800DC "_u02.bin"
+#ifdef CONFIG_SDIO_BT
+#define RWNX_MAC_PATCH_TABLE_8800DC_H_U02 RWNX_MAC_PATCH_TABLE_NAME_8800DC "_hbt_u02.bin"
+#else
 #define RWNX_MAC_PATCH_TABLE_8800DC_H_U02 RWNX_MAC_PATCH_TABLE_NAME_8800DC "_h_u02.bin"
+#endif
 
 #define RWNX_MAC_RF_PATCH_BASE_NAME_8800DC     "fmacfw_rf_patch_8800dc"
 #define RWNX_MAC_RF_PATCH_NAME_8800DC RWNX_MAC_RF_PATCH_BASE_NAME_8800DC".bin"
@@ -486,27 +501,32 @@ enum chip_rev {
 #define AICBT_TXPWR_LVL            0x00006020
 #define AICBT_TXPWR_LVL_8800dc            0x00006f2f
 #define AICBT_TXPWR_LVL_8800d80           0x00006f2f
+#define AICBT_TXPWR_LVL_8800d80x2           0x00006f2f
+
 
 #define AICBSP_HWINFO_DEFAULT       (-1)
 #define AICBSP_CPMODE_DEFAULT       AICBSP_CPMODE_WORK
 #define AICBSP_FWLOG_EN_DEFAULT     0
 
+#define AICBT_BTMODE_DEFAULT_8800d80x2    AICBT_BTMODE_BT_ONLY_COANT
 #define AICBT_BTMODE_DEFAULT_8800d80    AICBT_BTMODE_BT_ONLY_COANT
 #define AICBT_BTMODE_DEFAULT            AICBT_BTMODE_BT_ONLY_SW
+#ifdef CONFIG_SDIO_BT
+#define AICBT_BTPORT_DEFAULT            AICBT_BTPORT_MB
+#else
 #define AICBT_BTPORT_DEFAULT            AICBT_BTPORT_UART
+#endif
 #define AICBT_UART_BAUD_DEFAULT         AICBT_UART_BAUD_1_5M
 #define AICBT_UART_FC_DEFAULT           AICBT_UART_FLOWCTRL_ENABLE
 #define AICBT_LPM_ENABLE_DEFAULT 	    0
 #define AICBT_TXPWR_LVL_DEFAULT         AICBT_TXPWR_LVL
 #define AICBT_TXPWR_LVL_DEFAULT_8800dc  AICBT_TXPWR_LVL_8800dc
 #define AICBT_TXPWR_LVL_DEFAULT_8800d80 AICBT_TXPWR_LVL_8800d80
+#define AICBT_TXPWR_LVL_DEFAULT_8800d80x2 AICBT_TXPWR_LVL_8800d80x2
 
 
-//#define FEATURE_SDIO_CLOCK          50000000 // 0: default, other: target clock rate
-//#define FEATURE_SDIO_CLOCK_V3       150000000 // 0: default, other: target clock rate
-// some noise on sdio line
 #define FEATURE_SDIO_CLOCK          25000000 // 0: default, other: target clock rate
-#define FEATURE_SDIO_CLOCK_V3       25000000 // 0: default, other: target clock rate
+#define FEATURE_SDIO_CLOCK_V3       150000000 // 0: default, other: target clock rate
 #define FEATURE_SDIO_PHASE          2        // 0: default, 2: 180°
 
 struct aicbt_patch_table {
@@ -527,15 +547,21 @@ struct aicbt_info_t {
 };
 
 struct aicbt_patch_info_t {
-       uint32_t info_len;
-       uint32_t adid_addrinf;
-	uint32_t addr_adid;
-       uint32_t patch_addrinf;
-	uint32_t addr_patch;
-	uint32_t reset_addr;
-	uint32_t reset_val;
-	uint32_t adid_flag_addr;
-	uint32_t adid_flag;
+    uint32_t info_len;
+//base len start
+    uint32_t adid_addrinf;
+    uint32_t addr_adid;
+    uint32_t patch_addrinf;
+    uint32_t addr_patch;
+    uint32_t reset_addr;
+    uint32_t reset_val;
+    uint32_t adid_flag_addr;
+    uint32_t adid_flag;
+//base len end
+//ext patch nb
+    uint32_t ext_patch_nb_addr;
+    uint32_t ext_patch_nb;
+    uint32_t *ext_patch_param;
 };
 
 struct aicbsp_firmware {
@@ -544,6 +570,7 @@ struct aicbsp_firmware {
 	const char *bt_patch;
 	const char *bt_table;
 	const char *wl_fw;
+    const char *bt_ext_patch;
 };
 
 struct aicbsp_info_t {
@@ -565,5 +592,7 @@ extern const struct aicbsp_firmware fw_8800dc_u02[];
 extern const struct aicbsp_firmware fw_8800dc_h_u02[];
 extern const struct aicbsp_firmware fw_8800d80_u01[];
 extern const struct aicbsp_firmware fw_8800d80_u02[];
+extern const struct aicbsp_firmware fw_8800d80_h_u02[];
+extern const struct aicbsp_firmware fw_8800d80x2[];
 
 #endif

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic_bsp_export.h

@@ -31,7 +31,7 @@ struct aicbsp_feature_t {
 	uint8_t  irqf;
 };
 
-#ifdef CONFIG_DPD
+#if defined(CONFIG_DPD) || defined(CONFIG_LOFT_CALIB)
 typedef struct {
     uint32_t bit_mask[3];
     uint32_t reserved;
@@ -53,10 +53,16 @@ typedef struct {
 
 #define MEMBER_SIZE(type, member)   sizeof(((type *)0)->member)
 #define DPD_RESULT_SIZE_8800DC      sizeof(rf_misc_ram_lite_t)
+#endif
 
+#ifdef CONFIG_DPD
 extern rf_misc_ram_lite_t dpd_res;
 #endif
 
+#ifdef CONFIG_LOFT_CALIB
+extern rf_misc_ram_lite_t loft_res_local;
+#endif
+
 int aicbsp_set_subsys(int, int);
 int aicbsp_get_feature(struct aicbsp_feature_t *feature, char *fw_path);
 struct sk_buff *aicbsp_resv_mem_alloc_skb(unsigned int length, uint32_t id);

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aic_bsp_main.c

@@ -15,8 +15,9 @@
 #define DRV_AUTHOR            "AICSemi"
 #define DRV_VERS_MOD          "1.0"
 
-//int aicwf_dbg_level_bsp = LOGERROR|LOGINFO|LOGDEBUG|LOGTRACE;
-int aicwf_dbg_level_bsp = LOGERROR;
+int aicwf_dbg_level_bsp = LOGERROR|LOGINFO|LOGDEBUG|LOGTRACE;
+
+struct semaphore aicbsp_probe_semaphore;
 
 static struct platform_device *aicbsp_pdev;
 
@@ -28,7 +29,11 @@ const struct aicbsp_firmware fw_u02[] = {
 		.bt_adid       = "fw_adid.bin",
 		.bt_patch      = "fw_patch.bin",
 		.bt_table      = "fw_patch_table.bin",
+		#ifdef CONFIG_SDIO_BT
+		.wl_fw         = "fmacfwbt.bin"
+		#else
 		.wl_fw         = "fmacfw.bin"
+		#endif
 	},
 	[AICBSP_CPMODE_TEST] = {
 		.desc          = "rf test mode(sdio u02)",
@@ -47,6 +52,8 @@ const struct aicbsp_firmware fw_u03[] = {
 		.bt_table      = "fw_patch_table_u03.bin",
 		#ifdef CONFIG_MCU_MESSAGE
 		.wl_fw         = "fmacfw_8800m_custmsg.bin"
+		#elif defined(CONFIG_SDIO_BT)
+		.wl_fw         = "fmacfwbt.bin"
 		#else
 		.wl_fw         = "fmacfw.bin"
 		#endif
@@ -86,6 +93,7 @@ const struct aicbsp_firmware fw_8800dc_u02[] = {
 		.bt_adid       = "fw_adid_8800dc_u02.bin",
 		.bt_patch      = "fw_patch_8800dc_u02.bin",
 		.bt_table      = "fw_patch_table_8800dc_u02.bin",
+		.bt_ext_patch  = "fw_patch_8800dc_u02_ext",
 		.wl_fw         = "fmacfw_patch_8800dc_u02.bin"
 	},
 
@@ -94,6 +102,7 @@ const struct aicbsp_firmware fw_8800dc_u02[] = {
 		.bt_adid       = "fw_adid_8800dc_u02.bin",
 		.bt_patch      = "fw_patch_8800dc_u02.bin",
 		.bt_table      = "fw_patch_table_8800dc_u02.bin",
+		.bt_ext_patch  = "fw_patch_8800dc_u02_ext",
 		.wl_fw         = "lmacfw_rf_8800dc.bin" //u01,u02 lmacfw load same bin
 	},
 };
@@ -104,6 +113,7 @@ const struct aicbsp_firmware fw_8800dc_h_u02[] = {
 		.bt_adid       = "fw_adid_8800dc_u02h.bin",
 		.bt_patch      = "fw_patch_8800dc_u02h.bin",
 		.bt_table      = "fw_patch_table_8800dc_u02h.bin",
+		.bt_ext_patch  = "fw_patch_8800dc_u02h_ext",
 		.wl_fw         = "fmacfw_patch_8800dc_h_u02.bin"
 	},
 
@@ -112,6 +122,7 @@ const struct aicbsp_firmware fw_8800dc_h_u02[] = {
 		.bt_adid       = "fw_adid_8800dc_u02h.bin",
 		.bt_patch      = "fw_patch_8800dc_u02h.bin",
 		.bt_table      = "fw_patch_table_8800dc_u02h.bin",
+		.bt_ext_patch  = "fw_patch_8800dc_u02h_ext",
 		.wl_fw         = "lmacfw_rf_8800dc.bin" //u01,u02 lmacfw load same bin
 	},
 };
@@ -141,7 +152,14 @@ const struct aicbsp_firmware fw_8800d80_u02[] = {
 		.bt_adid       = "fw_adid_8800d80_u02.bin",
 		.bt_patch      = "fw_patch_8800d80_u02.bin",
 		.bt_table      = "fw_patch_table_8800d80_u02.bin",
-		.wl_fw         = "fmacfw_8800d80_u02.bin"
+	#if defined CONFIG_SDIO_BT
+		.wl_fw         = "fmacfwbt_8800d80_u02.bin",
+	#elif defined CONFIG_FOR_IPCAM
+		.wl_fw		   = "fmacfw_8800d80_u02_ipc.bin",
+	#else
+		.wl_fw         = "fmacfw_8800d80_u02.bin",
+	#endif
+        .bt_ext_patch  = "fw_patch_8800d80_u02_ext"
 	},
 
 	[AICBSP_CPMODE_TEST] = {
@@ -149,7 +167,58 @@ const struct aicbsp_firmware fw_8800d80_u02[] = {
 		.bt_adid       = "fw_adid_8800d80_u02.bin",
 		.bt_patch      = "fw_patch_8800d80_u02.bin",
 		.bt_table      = "fw_patch_table_8800d80_u02.bin",
-		.wl_fw         = "lmacfw_rf_8800d80_u02.bin"
+		.wl_fw         = "lmacfw_rf_8800d80_u02.bin",
+		.bt_ext_patch  = "fw_patch_8800d80_u02_ext"
+	},
+};
+
+const struct aicbsp_firmware fw_8800d80_h_u02[] = {
+	[AICBSP_CPMODE_WORK] = {
+		.desc          = "normal work mode(8800d80 sdio h_u02)",
+		.bt_adid       = "fw_adid_8800d80_u02.bin",
+		.bt_patch      = "fw_patch_8800d80_u02.bin",
+		.bt_table      = "fw_patch_table_8800d80_u02.bin",
+	#if defined CONFIG_SDIO_BT
+		.wl_fw         = "fmacfwbt_8800d80_h_u02.bin",
+	#elif defined CONFIG_FOR_IPCAM
+		.wl_fw         = "fmacfw_8800d80_h_u02_ipc.bin",
+	#else
+		.wl_fw         = "fmacfw_8800d80_h_u02.bin",
+	#endif
+        .bt_ext_patch  = "fw_patch_8800d80_u02_ext"
+	},
+
+	[AICBSP_CPMODE_TEST] = {
+		.desc          = "rf test mode(8800d80 sdio u02)",
+		.bt_adid       = "fw_adid_8800d80_u02.bin",
+		.bt_patch      = "fw_patch_8800d80_u02.bin",
+		.bt_table      = "fw_patch_table_8800d80_u02.bin",
+		.wl_fw         = "lmacfw_rf_8800d80_u02.bin",
+		.bt_ext_patch  = "fw_patch_8800d80_u02_ext"
+	},
+};
+
+const struct aicbsp_firmware fw_8800d80x2[] = {
+	[AICBSP_CPMODE_WORK] = {
+		.desc          = "normal work mode(8800d80x2 sdio)",
+		.bt_adid       = "fw_adid_8800d80x2_u05.bin",
+		.bt_patch      = "fw_patch_8800d80x2_u05.bin",
+		.bt_table      = "fw_patch_table_8800d80x2_u05.bin",
+	#ifdef CONFIG_SDIO_BT
+		.wl_fw         = "fmacfwbt_8800d80_h_u02.bin",
+	#else
+		.wl_fw         = "fmacfw_8800d80x2.bin",
+	#endif
+        .bt_ext_patch  = "fw_patch_8800d80x2_u05_ext"
+	},
+
+	[AICBSP_CPMODE_TEST] = {
+		.desc          = "rf test mode(8800d80x2 sdio)",
+		.bt_adid       = "fw_adid_8800d80x2_u05.bin",
+		.bt_patch      = "fw_patch_8800d80x2_u05.bin",
+		.bt_table      = "fw_patch_table_8800d80x2_u05.bin",
+		.wl_fw         = "lmacfw_rf_8800d80x2.bin",
+		.bt_ext_patch  = "fw_patch_8800d80x2_u05_ext"
 	},
 };
 
@@ -328,6 +397,9 @@ static int __init aicbsp_init(void)
 	aicbsp_info.cpmode = testmode;
 
 	aicbsp_resv_mem_init();
+    
+    sema_init(&aicbsp_probe_semaphore, 0);
+    
 	ret = platform_driver_register(&aicbsp_driver);
 	if (ret) {
 		pr_err("register platform driver failed: %d\n", ret);
@@ -348,7 +420,7 @@ static int __init aicbsp_init(void)
 	}
 
 	mutex_init(&aicbsp_power_lock);
-#ifdef CONFIG_PLATFORM_ROCKCHIP
+#if defined CONFIG_PLATFORM_ROCKCHIP || defined CONFIG_PLATFORM_ROCKCHIP2
 	aicbsp_set_subsys(AIC_BLUETOOTH, AIC_PWR_ON);
 #endif
 	return 0;
@@ -359,7 +431,7 @@ extern struct aic_sdio_dev *aicbsp_sdiodev;
 
 static void __exit aicbsp_exit(void)
 {
-#ifdef CONFIG_PLATFORM_ROCKCHIP
+#if defined CONFIG_PLATFORM_ROCKCHIP || defined CONFIG_PLATFORM_ROCKCHIP2
     if(aicbsp_sdiodev){
     	aicbsp_sdio_exit();
     }

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aicsdio.c

@@ -48,15 +48,17 @@ static void aicbsp_platform_power_off(void);
 
 struct aic_sdio_dev *aicbsp_sdiodev = NULL;
 static struct semaphore *aicbsp_notify_semaphore;
+extern struct semaphore aicbsp_probe_semaphore;
+
 static const struct sdio_device_id aicbsp_sdmmc_ids[];
 static bool aicbsp_load_fw_in_fdrv = false;
 
 #define FW_PATH_MAX 200
 
 //#ifdef CONFIG_PLATFORM_UBUNTU
-char* aic_default_fw_path = "/usr/lib/firmware/aic8800_sdio/aic8800";
+//static const char* aic_default_fw_path = "/lib/firmware/aic8800_sdio";
 //#else
-//static const char* aic_default_fw_path = CONFIG_AIC_FW_PATH;
+static const char* aic_default_fw_path = CONFIG_AIC_FW_PATH;
 //#endif
 char aic_fw_path[FW_PATH_MAX];
 module_param_string(aic_fw_path, aic_fw_path, FW_PATH_MAX, 0660);
@@ -75,10 +77,12 @@ extern int testmode;
 #define SDIO_VENDOR_ID_AIC8801              0x5449
 #define SDIO_VENDOR_ID_AIC8800DC            0xc8a1
 #define SDIO_VENDOR_ID_AIC8800D80           0xc8a1
+#define SDIO_VENDOR_ID_AIC8800D80X2         0xc8a1
 
 #define SDIO_DEVICE_ID_AIC8801				0x0145
 #define SDIO_DEVICE_ID_AIC8800DC			0xc08d
 #define SDIO_DEVICE_ID_AIC8800D80           0x0082
+#define SDIO_DEVICE_ID_AIC8800D80X2         0x2082
 
 
 static int aicbsp_dummy_probe(struct sdio_func *func, const struct sdio_device_id *id)
@@ -242,6 +246,10 @@ static int aicwf_sdio_chipmatch(struct aic_sdio_dev *sdio_dev, uint16_t vid, uin
 		sdio_dev->chipid = PRODUCT_ID_AIC8800D80;
 		AICWFDBG(LOGINFO, "%s USE AIC8800D80\r\n", __func__);
 		return 0;
+	}else if(vid == SDIO_VENDOR_ID_AIC8800D80X2 && did == SDIO_DEVICE_ID_AIC8800D80X2){
+		sdio_dev->chipid = PRODUCT_ID_AIC8800D80X2;
+		AICWFDBG(LOGINFO, "%s USE AIC8800D80X2\r\n", __func__);
+		return 0;
 	}else{
 		return -1;
 	}
@@ -264,6 +272,11 @@ static int aicbsp_sdio_probe(struct sdio_func *func,
 	struct aicwf_bus *bus_if;
 	int err = -ENODEV;
 
+	if (func == NULL) {
+		sdio_err("%s func is null\n", __func__);
+		return err;
+	}
+
 	sdio_dbg("%s:%d vid:0x%04X  did:0x%04X\n", __func__, func->num,
 		func->vendor, func->device);
 
@@ -283,8 +296,11 @@ static int aicbsp_sdio_probe(struct sdio_func *func,
 		return err;
 	}
 
-	func = func->card->sdio_func[1 - 1]; //replace 2 with 1
 	host = func->card->host;
+	host->caps |= MMC_CAP_NONREMOVABLE;
+
+	func = func->card->sdio_func[1 - 1]; //replace 2 with 1
+
 	sdio_dbg("%s after replace:%d\n", __func__, func->num);
 
 	bus_if = kzalloc(sizeof(struct aicwf_bus), GFP_KERNEL);
@@ -313,12 +329,11 @@ static int aicbsp_sdio_probe(struct sdio_func *func,
 	if(sdiodev->chipid == PRODUCT_ID_AIC8800DC || sdiodev->chipid == PRODUCT_ID_AIC8800DW){
 		dev_set_drvdata(&sdiodev->func_msg->dev, bus_if);
 		printk("the device is PRODUCT_ID_AIC8800DC \n");
-		aic_default_fw_path = "/usr/lib/firmware/aic8800_sdio/aic8800DC";
 	}
 	dev_set_drvdata(&func->dev, bus_if);
 	sdiodev->dev = &func->dev;
 
-    if (sdiodev->chipid != PRODUCT_ID_AIC8800D80) {
+    if (sdiodev->chipid != PRODUCT_ID_AIC8800D80 && sdiodev->chipid != PRODUCT_ID_AIC8800D80X2) {
 	    err = aicwf_sdio_func_init(sdiodev);
     } else {
         err = aicwf_sdiov3_func_init(sdiodev);
@@ -332,9 +347,11 @@ static int aicbsp_sdio_probe(struct sdio_func *func,
 		sdio_err("sdio bus init err\r\n");
 		goto fail;
 	}
-	host->caps |= MMC_CAP_NONREMOVABLE;
+
 	aicbsp_platform_init(sdiodev);
 
+	up(&aicbsp_probe_semaphore);
+
 	return 0;
 fail:
 	aicwf_sdio_func_deinit(sdiodev);
@@ -344,33 +361,37 @@ fail:
 	return err;
 }
 
+
 static void aicbsp_sdio_remove(struct sdio_func *func)
 {
 	struct mmc_host *host;
 	struct aicwf_bus *bus_if = NULL;
 	struct aic_sdio_dev *sdiodev = NULL;
 
-	sdio_dbg("%s\n", __func__);
+	AICWFDBG(LOGINFO, "%s\n", __func__);
 	if (aicbsp_sdiodev == NULL) {
-		sdio_dbg("%s: allready unregister\n", __func__);
-		return;
+		AICWFDBG(LOGERROR, "%s: allready unregister\n", __func__);
+		goto done;
+	}
+	if (func == NULL) {
+		AICWFDBG(LOGERROR, "%s, sdio func is null\n", __func__);
+		goto done;
 	}
 
-    bus_if = aicbsp_get_drvdata(&func->dev);
-
-	if (!bus_if) {
-        AICWFDBG(LOGERROR, "%s bus_if is NULL \r\n", __func__);
-		return;
-	}
-
-	func = aicbsp_sdiodev->func;
 	host = func->card->host;
 	host->caps &= ~MMC_CAP_NONREMOVABLE;
 
+	bus_if = aicbsp_get_drvdata(&func->dev);
+
+	if (!bus_if) {
+		AICWFDBG(LOGERROR, "%s bus_if is NULL \r\n", __func__);
+		goto done;
+	}
+
 	sdiodev = bus_if->bus_priv.sdio;
 	if (!sdiodev) {
-        AICWFDBG(LOGERROR, "%s sdiodev is NULL \r\n", __func__);
-		return;
+		AICWFDBG(LOGERROR, "%s sdiodev is NULL \r\n", __func__);
+		goto done;
 	}
 
 	aicwf_sdio_release(sdiodev);
@@ -378,29 +399,26 @@ static void aicbsp_sdio_remove(struct sdio_func *func)
 
 	dev_set_drvdata(&sdiodev->func->dev, NULL);
 	kfree(sdiodev);
-	kfree(bus_if);
+
+done:
+	if (bus_if)
+		kfree(bus_if);
 	aicbsp_sdiodev = NULL;
 	sdio_dbg("%s done\n", __func__);
 }
 
+
 static int aicbsp_sdio_suspend(struct device *dev)
 {
 	struct sdio_func *func = dev_to_sdio_func(dev);
 	int err;
 	mmc_pm_flag_t sdio_flags;
 
-#ifdef CONFIG_PLATFORM_ROCKCHIP
+#if defined(CONFIG_PLATFORM_ROCKCHIP) || defined(CONFIG_PLATFORM_ROCKCHIP2)
 #ifdef CONFIG_GPIO_WAKEUP
     //BT_SLEEP:true,BT_WAKEUP:false
     rfkill_rk_sleep_bt(false);
 #endif
-#endif
-
-#ifdef CONFIG_PLATFORM_ROCKCHIP2
-#ifdef CONFIG_GPIO_WAKEUP
-        //BT_SLEEP:true,BT_WAKEUP:false
-        rfkill_rk_sleep_bt(false);
-#endif
 #endif
 
 	sdio_dbg("%s, func->num = %d\n", __func__, func->num);
@@ -420,7 +438,7 @@ static int aicbsp_sdio_suspend(struct device *dev)
 		return err;
 	}
 
-#ifdef CONFIG_PLATFORM_ROCKCHIP
+#if defined(CONFIG_PLATFORM_ROCKCHIP) || defined(CONFIG_PLATFORM_ROCKCHIP2)
 #ifdef CONFIG_GPIO_WAKEUP
 		//BT_SLEEP:true,BT_WAKEUP:false
 		rfkill_rk_sleep_bt(true);
@@ -428,15 +446,6 @@ static int aicbsp_sdio_suspend(struct device *dev)
 #endif
 #endif
 
-#ifdef CONFIG_PLATFORM_ROCKCHIP2
-#ifdef CONFIG_GPIO_WAKEUP
-            //BT_SLEEP:true,BT_WAKEUP:false
-            rfkill_rk_sleep_bt(true);
-            printk("%s BT wake to SLEEP\r\n", __func__);
-#endif
-#endif
-
-
 	return 0;
 }
 
@@ -444,6 +453,13 @@ static int aicbsp_sdio_resume(struct device *dev)
 {
 	sdio_dbg("%s\n", __func__);
 
+#if defined(CONFIG_PLATFORM_ROCKCHIP) || defined(CONFIG_PLATFORM_ROCKCHIP2)
+#ifdef CONFIG_GPIO_WAKEUP
+		//BT_SLEEP:true,BT_WAKEUP:false
+		rfkill_rk_sleep_bt(false);
+#endif
+#endif
+
 	return 0;
 }
 
@@ -571,11 +587,18 @@ static void aicbsp_platform_power_off(void)
 
 int aicbsp_sdio_init(void)
 {
+
 	if (sdio_register_driver(&aicbsp_sdio_driver)) {
 		return -1;
 	} else {
 		//may add mmc_rescan here
 	}
+	if (down_timeout(&aicbsp_probe_semaphore, msecs_to_jiffies(2000)) != 0){
+		printk("%s aicbsp_sdio_probe fail\r\n", __func__);
+		return -1;
+	}
+
+	
 	return 0;
 }
 
@@ -734,7 +757,7 @@ int aicwf_sdio_wakeup(struct aic_sdio_dev *sdiodev)
         sdiodev->chipid == PRODUCT_ID_AIC8800DC ||
         sdiodev->chipid == PRODUCT_ID_AIC8800DW) {
         wakeup_reg_val = 1;
-    } else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80) {
+    } else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80 || sdiodev->chipid == PRODUCT_ID_AIC8800D80X2) {
         wakeup_reg_val = 0x11;
     }
 
@@ -954,7 +977,8 @@ static int aicwf_sdio_tx_msg(struct aic_sdio_dev *sdiodev)
 	} else
 		len = payload_len;
 
-	if(sdiodev->chipid == PRODUCT_ID_AIC8801 || sdiodev->chipid == PRODUCT_ID_AIC8800D80){
+	if(sdiodev->chipid == PRODUCT_ID_AIC8801 || sdiodev->chipid == PRODUCT_ID_AIC8800D80 || 
+		sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
 		buffer_cnt = aicwf_sdio_flow_ctrl(sdiodev);
 		while ((buffer_cnt <= 0 || (buffer_cnt > 0 && len > (buffer_cnt * BUFFER_SIZE))) && retry < 10) {
 			retry++;
@@ -964,7 +988,8 @@ static int aicwf_sdio_tx_msg(struct aic_sdio_dev *sdiodev)
 	}
 	down(&sdiodev->tx_priv->cmd_txsema);
 
-	if(sdiodev->chipid == PRODUCT_ID_AIC8801 || sdiodev->chipid == PRODUCT_ID_AIC8800D80){
+	if(sdiodev->chipid == PRODUCT_ID_AIC8801 || sdiodev->chipid == PRODUCT_ID_AIC8800D80 ||
+		sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
 		if (buffer_cnt > 0 && len < (buffer_cnt * BUFFER_SIZE)) {
 			err = aicwf_sdio_send_pkt(sdiodev, payload, len);
 			if (err) {
@@ -1198,7 +1223,7 @@ int aicwf_sdio_aggr(struct aicwf_tx_priv *tx_priv, struct sk_buff *pkt)
 	if (tx_priv->sdiodev->chipid == PRODUCT_ID_AIC8801 || tx_priv->sdiodev->chipid == PRODUCT_ID_AIC8800DC ||
         tx_priv->sdiodev->chipid == PRODUCT_ID_AIC8800DW)
         sdio_header[3] = 0; //reserved
-    else if (tx_priv->sdiodev->chipid == PRODUCT_ID_AIC8800D80)
+    else if (tx_priv->sdiodev->chipid == PRODUCT_ID_AIC8800D80  || tx_priv->sdiodev->chipid == PRODUCT_ID_AIC8800D80X2)
 	    sdio_header[3] = crc8_ponl_107(&sdio_header[0], 3); // crc8
 
 	memcpy(tx_priv->tail, (u8 *)&sdio_header, sizeof(sdio_header));
@@ -1305,7 +1330,7 @@ static int aicwf_sdio_bus_start(struct device *dev)
 
 		if (ret != 0)
 			sdio_err("func2 intr register failed:%d\n", ret);
-	}else if(sdiodev->chipid == PRODUCT_ID_AIC8800D80){
+	}else if(sdiodev->chipid == PRODUCT_ID_AIC8800D80 || sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
 		sdio_claim_host(sdiodev->func);
 		sdio_claim_irq(sdiodev->func, aicwf_sdio_hal_irqhandler);
 
@@ -1446,7 +1471,7 @@ void aicwf_sdio_hal_irqhandler(struct sdio_func *func)
 
     	    ret = aicwf_sdio_readb(sdiodev, sdiodev->sdio_reg.block_cnt_reg, &intstatus);
     	}
-    }else if (sdiodev->chipid  == PRODUCT_ID_AIC8800D80) {
+    }else if (sdiodev->chipid  == PRODUCT_ID_AIC8800D80 || sdiodev->chipid  == PRODUCT_ID_AIC8800D80X2) {
         do {
             ret = aicwf_sdio_readb(sdiodev, sdiodev->sdio_reg.misc_int_status_reg, &intstatus);
             if (!ret) {
@@ -1601,22 +1626,33 @@ void aicwf_sdio_release_func2(struct aic_sdio_dev *sdiodev)
 
 void aicwf_sdio_release(struct aic_sdio_dev *sdiodev)
 {
-	struct aicwf_bus *bus_if;
+	struct aicwf_bus *bus_if = NULL;
+	struct aicwf_bus *bus_if_t = NULL;
 	int ret = 0;
 
 	sdio_dbg("%s\n", __func__);
+	if (sdiodev->func == NULL) {
+		printk("%s, NULL sdio func\n", __func__);
+		return;
+	}
 
 	bus_if = aicbsp_get_drvdata(sdiodev->dev);
-	bus_if->state = BUS_DOWN_ST;
+	if (bus_if)
+		bus_if->state = BUS_DOWN_ST;
 
-	sdio_claim_host(sdiodev->func);
-	//disable sdio interrupt
-	ret = aicwf_sdio_writeb(sdiodev, sdiodev->sdio_reg.intr_config_reg, 0x0);
-	if (ret < 0) {
-		sdio_err("reg:%d write failed!, ret=%d\n", sdiodev->sdio_reg.intr_config_reg, ret);
+	bus_if_t = dev_get_drvdata(sdiodev->dev);
+
+	if ((bus_if_t != NULL) && (sdiodev->bus_if == bus_if_t)) {
+		sdio_dbg("%s bsp release\n", __func__);
+		sdio_claim_host(sdiodev->func);
+		//disable sdio interrupt
+		ret = aicwf_sdio_writeb(sdiodev, sdiodev->sdio_reg.intr_config_reg, 0x0);
+		if (ret < 0) {
+			sdio_err("reg:%d write failed!, ret=%d\n", sdiodev->sdio_reg.intr_config_reg, ret);
+		}
+		sdio_release_irq(sdiodev->func);
+		sdio_release_host(sdiodev->func);
 	}
-	sdio_release_irq(sdiodev->func);
-	sdio_release_host(sdiodev->func);
 
 	if(sdiodev->chipid == PRODUCT_ID_AIC8800DC || sdiodev->chipid == PRODUCT_ID_AIC8800DW){
 		aicwf_sdio_release_func2(sdiodev);
@@ -1634,6 +1670,8 @@ void aicwf_sdio_release(struct aic_sdio_dev *sdiodev)
 	rwnx_cmd_mgr_deinit(&sdiodev->cmd_mgr);
 }
 
+
+
 void aicwf_sdio_reg_init(struct aic_sdio_dev *sdiodev)
 {
     sdio_dbg("%s\n", __func__);
@@ -1650,7 +1688,7 @@ void aicwf_sdio_reg_init(struct aic_sdio_dev *sdiodev)
         sdiodev->sdio_reg.block_cnt_reg =          SDIOWIFI_BLOCK_CNT_REG;
         sdiodev->sdio_reg.rd_fifo_addr =           SDIOWIFI_RD_FIFO_ADDR;
         sdiodev->sdio_reg.wr_fifo_addr =           SDIOWIFI_WR_FIFO_ADDR;
-	} else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80){
+	} else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80 || sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
         sdiodev->sdio_reg.bytemode_len_reg =       SDIOWIFI_BYTEMODE_LEN_REG_V3;
         sdiodev->sdio_reg.intr_config_reg =        SDIOWIFI_INTR_ENABLE_REG_V3;
         sdiodev->sdio_reg.sleep_reg =              SDIOWIFI_INTR_PENDING_REG_V3;
@@ -1842,16 +1880,35 @@ int aicwf_sdiov3_func_init(struct aic_sdio_dev *sdiodev)
 
 void aicwf_sdio_func_deinit(struct aic_sdio_dev *sdiodev)
 {
-	sdio_claim_host(sdiodev->func);
-	sdio_disable_func(sdiodev->func);
-	sdio_release_host(sdiodev->func);
+	struct aicwf_bus *bus_if = NULL;
+
+	if (sdiodev->func == NULL) {
+		sdio_err("%s, NULL sdio func\n", __func__);
+		return;
+	}
+
+	bus_if = dev_get_drvdata(sdiodev->dev);
+	if (bus_if == NULL) {
+		sdio_err("%s, bus_if is null\n", __func__);
+		return;
+	}
+
+	if (sdiodev->bus_if == bus_if) {
+		sdio_dbg("%s bsp disable\n", __func__);
+		sdio_claim_host(sdiodev->func);
+		sdio_disable_func(sdiodev->func);
+		sdio_release_host(sdiodev->func);
+	}
+
 	if(sdiodev->chipid == PRODUCT_ID_AIC8800DC || sdiodev->chipid == PRODUCT_ID_AIC8800DW){
 		sdio_claim_host(sdiodev->func_msg);
 		sdio_disable_func(sdiodev->func_msg);
 		sdio_release_host(sdiodev->func_msg);
 	}
+
 }
 
+
 void *aicwf_sdio_bus_init(struct aic_sdio_dev *sdiodev)
 {
 	int ret;
@@ -1944,6 +2001,11 @@ void set_irq_handler(void *fn){
     aicbsp_sdiodev->sdio_hal_irqhandler = (sdio_irq_handler_t *)fn;
 }
 
+extern int adap_test;
+int get_adap_test(void){
+    return adap_test;
+}
+
 uint8_t crc8_ponl_107(uint8_t *p_buffer, uint16_t cal_size)
 {
     uint8_t i;
@@ -1972,4 +2034,5 @@ EXPORT_SYMBOL(get_fw_path);
 EXPORT_SYMBOL(get_testmode);
 EXPORT_SYMBOL(get_sdio_func);
 EXPORT_SYMBOL(set_irq_handler);
+EXPORT_SYMBOL(get_adap_test);
 

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aicsdio.h

@@ -69,7 +69,8 @@ enum AICWF_IC{
 	PRODUCT_ID_AIC8801	=	0,
 	PRODUCT_ID_AIC8800DC,
 	PRODUCT_ID_AIC8800DW,
-	PRODUCT_ID_AIC8800D80
+	PRODUCT_ID_AIC8800D80,
+	PRODUCT_ID_AIC8800D80X2
 };
 
 struct aic_sdio_reg {
@@ -108,6 +109,7 @@ struct aic_sdio_dev {
 	struct semaphore pwrctl_wakeup_sema;
 #endif
 	u16 chipid;
+	u32 fw_version_uint;
     struct aic_sdio_reg sdio_reg;
     void (*sdio_hal_irqhandler) (struct sdio_func *func);
 };

osdrv/extdrv/wireless/aic8800/aic8800_bsp/aicsdio_txrxif.c

@@ -41,21 +41,22 @@ int aicwf_bus_init(uint bus_hdrlen, struct device *dev)
 	init_completion(&bus_if->busrx_trgg);
 #ifdef AICWF_SDIO_SUPPORT
 	bus_if->bustx_thread = kthread_run(aicwf_sdio_bustx_thread, (void *)bus_if, "aicwf_bustx_thread");
-	bus_if->busrx_thread = kthread_run(aicwf_sdio_busrx_thread, (void *)bus_if->bus_priv.sdio->rx_priv, "aicwf_busrx_thread");
-#endif
-
 	if (IS_ERR(bus_if->bustx_thread)) {
 		bus_if->bustx_thread  = NULL;
 		txrx_err("aicwf_bustx_thread run fail\n");
+		ret = -1;
 		goto fail;
 	}
 
+	bus_if->busrx_thread = kthread_run(aicwf_sdio_busrx_thread, (void *)bus_if->bus_priv.sdio->rx_priv, "aicwf_busrx_thread");
 	if (IS_ERR(bus_if->busrx_thread)) {
 		bus_if->busrx_thread  = NULL;
 		txrx_err("aicwf_bustx_thread run fail\n");
+		ret = -1;
 		goto fail;
 	}
 
+#endif
 	return ret;
 fail:
 	aicwf_bus_deinit(dev);

osdrv/extdrv/wireless/aic8800/aic8800_bsp/rwnx_version_gen.h

@@ -1,4 +1,4 @@
 #define RWNX_VERS_REV "241c091M (master)"
 #define RWNX_VERS_MOD "6.4.3.0"
 #define RWNX_VERS_BANNER "rwnx v6.4.3.0 - - 241c091M (master)"
-#define RELEASE_DATE "2024_0109_ec460377"
+#define RELEASE_DATE "2025_0926_91c9dae5"

osdrv/extdrv/wireless/aic8800/aic8800_btlpm/Makefile

@@ -12,38 +12,23 @@ CONFIG_PLATFORM_AMLOGIC ?= n
 CONFIG_PLATFORM_UBUNTU ?= y
 
 
-CONFIG_SUPPORT_LPM = y
+CONFIG_SUPPORT_LPM ?= y
 CONFIG_AUTO_PM ?= n
 
 aic8800_btlpm-y := \
 	aic_bluetooth_main.o \
 	rfkill.o \
 
-ifeq ($(CONFIG_PLATFORM_UBUNTU), n)
-	aic8800_btlpm-$(CONFIG_SUPPORT_LPM) += lpm.o
-endif
+aic8800_btlpm-$(CONFIG_SUPPORT_LPM) += lpm.o
 
 ccflags-y += -DAIC_TRACE_INCLUDE_PATH=$(src)
 
 ccflags-$(CONFIG_AUTO_PM) += -DCONFIG_AUTO_PM
 
 ifeq ($(CONFIG_PLATFORM_ROCKCHIP), y)
-KDIR  ?= /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/kernel
-ARCH ?= arm
-CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/prebuilts/gcc/linux-x86/arm/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR  ?= /home/yaya/E/Rockchip/3229/Android10/SDK/kernel/
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android10/SDK/prebuilts/gcc/linux-x86/arm/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR  ?= /home/yaya/E/Rockchip/3288/Android10/kernel/kernel/
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3288/Android10/tool/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux#-gnueabihf-
-#KDIR ?= /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/kernel
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
-#KDIR ?= /home/yaya/E/Rockchip/3328/Android9/SDK/SDK/kernel
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3328/Android9/SDK/SDK/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
-
+ARCH = arm64
+KDIR = /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/kernel
+CROSS_COMPILE = /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
 ccflags-$(CONFIG_PLATFORM_ROCKCHIP) += -DCONFIG_PLATFORM_ROCKCHIP
 ccflags-y += -DANDROID_PLATFORM
 endif

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/Makefile

@@ -72,38 +72,72 @@ CONFIG_ARP_OFFLOAD =y
 CONFIG_RADAR_OR_IR_DETECT =n
 CONFIG_DOWNLOAD_FW =n
 CONFIG_RFTEST=y
-CONFIG_USB_BT =y
+CONFIG_USB_BT =n
+CONFIG_SDIO_BT=y
 CONFIG_USE_5G ?= y
-CONFIG_SDIO_PWRCTRL ?= y
 CONFIG_CREATE_TRACE_POINTS = n
 CONFIG_TXRX_THREAD_PRIO = y
 # CONFIG_COEX = n for BT_ONLY, CONFIG_COEX =y for combo and sw
 CONFIG_COEX = y
 CONFIG_RX_NETIF_RECV_SKB = y
-CONFIG_GPIO_WAKEUP = n
 CONFIG_SET_VENDOR_EXTENSION_IE = n
 CONFIG_SUPPORT_REALTIME_CHANGE_MAC = y
 CONFIG_WPA3_FOR_OLD_KERNEL ?= n
 CONFIG_VHT_FOR_OLD_KERNEL ?= n
 CONFIG_HE_FOR_OLD_KERNEL ?= n
-CONFIG_PREALLOC_RX_SKB = n
+CONFIG_PREALLOC_RX_SKB ?= n
 CONFIG_WIFI_SUSPEND_FOR_LINUX = n
 # Need to set fw path in BOARD_KERNEL_CMDLINE
-CONFIG_USE_FW_REQUEST = n
+CONFIG_USE_FW_REQUEST ?= n
 CONFIG_USE_P2P0=n
+CONFIG_TX_NETIF_FLOWCTRL = n
+CONFIG_ONE_TXQ = n
 CONFIG_BR_SUPPORT =n
 BR_NAME = br0
 CONFIG_FDRV_NO_REG_SDIO=n
 CONFIG_SCHED_SCAN = n
-CONFIG_OOB = n
+CONFIG_OOB ?= n
 CONFIG_USE_CUSTOMER_MAC = n
-CONFIG_PREALLOC_TXQ = y
+CONFIG_PREALLOC_TXQ ?= y
 CONFIG_DPD = y
 CONFIG_FORCE_DPD_CALIB = y
-CONFIG_FILTER_TCP_ACK =n
-CONFIG_RESV_MEM_SUPPORT = y
+CONFIG_LOFT_CALIB = n
+CONFIG_FILTER_TCP_ACK =y
+CONFIG_RESV_MEM_SUPPORT ?= y
 CONFIG_GKI = n
 CONFIG_TEMP_COMP = n
+CONFIG_TEMP_CONTROL = n
+CONFIG_EXT_FEM_8800DCDW = n
+CONFIG_SHUTDOWN_CALLBACK = y
+CONFIG_FOR_IPCAM = n
+CONFIG_SDIO_ADMA = n
+# CONFIG_MCC = n for sta and p2p concurrent in same channel.
+CONFIG_MCC = y
+CONFIG_APF = n
+CONFIG_POWER_LIMIT = n
+CONFIG_BAND_STEERING = n
+CONFIG_PRBREQ_REPORT = n
+
+#CONFIG FOR LOW POWER MODE
+CONFIG_SDIO_PWRCTRL ?= n
+CONFIG_GPIO_WAKEUP ?= n
+CONFIG_AUTO_POWERSAVE = n
+
+# Enable wifi-hal Latency Mode
+CONFIG_AICWF_LATENCY_MODE = n
+
+#support D80X2 can write rf result to file
+CONFIG_WRITE_FILE_D80X2 = n
+
+ifneq ($(CONFIG_WIRELESS_EXT), y)
+CONFIG_USE_WIRELESS_EXT = n
+endif
+
+ifeq ($(CONFIG_EXT_FEM_8800DCDW), y)
+CONFIG_DPD = n
+CONFIG_FORCE_DPD_CALIB = n
+CONFIG_LOFT_CALIB = y
+endif
 
 # Support of MU-MIMO transmission (need FW support)
 ifeq ($(CONFIG_RWNX_BFMER), y)
@@ -119,7 +153,10 @@ CONFIG_RWNX_RADAR ?= y
 CONFIG_RWNX_BCMC ?= y
 
 # Enable Monitor+Data interface support (need FW support)
-CONFIG_RWNX_MON_DATA =y
+CONFIG_RWNX_MON_DATA = n
+CONFIG_RWNX_MON_XMIT = n
+CONFIG_RWNX_MON_RXFILTER = n
+
 
 # extra DEBUG config
 CONFIG_RWNX_SW_PROFILING ?= n
@@ -153,8 +190,11 @@ $(MODULE_NAME)-y := \
 	aicwf_compat_8800d80.o \
 	rwnx_wakelock.o		\
 	regdb.o				   \
+	aic_priv_cmd.o		\
 	aicwf_rx_prealloc.o
 
+$(MODULE_NAME)-$(CONFIG_BAND_STEERING)    += aicwf_manager.o    \
+	aicwf_steering.o
 $(MODULE_NAME)-$(CONFIG_BR_SUPPORT)       += aic_br_ext.o
 $(MODULE_NAME)-$(CONFIG_RWNX_RADAR)       += rwnx_radar.o
 $(MODULE_NAME)-$(CONFIG_DEBUG_FS)         += rwnx_debugfs.o
@@ -166,6 +206,8 @@ $(MODULE_NAME)-$(CONFIG_SDIO_SUPPORT)     += sdio_host.o
 $(MODULE_NAME)-$(CONFIG_SDIO_SUPPORT)     += aicwf_txrxif.o
 $(MODULE_NAME)-$(CONFIG_SDIO_SUPPORT)     += aicwf_sdio.o
 $(MODULE_NAME)-$(CONFIG_FILTER_TCP_ACK)   += aicwf_tcp_ack.o
+$(MODULE_NAME)-$(CONFIG_SDIO_BT)   += aic_btsdio.o
+$(MODULE_NAME)-$(CONFIG_SDIO_BT)   += btsdio.o
 
 $(MODULE_NAME)-$(CONFIG_USB_SUPPORT)     += usb_host.o
 $(MODULE_NAME)-$(CONFIG_USB_SUPPORT)     += aicwf_txrxif.o
@@ -216,6 +258,9 @@ ccflags-y += -I$(srctree)/$(src)/../aic8800_bsp
 ccflags-y += -DCONFIG_AIC_FW_PATH=\"$(CONFIG_AIC_FW_PATH)\"
 ccflags-$(CONFIG_RWNX_RADAR) += -DCONFIG_RWNX_RADAR
 ccflags-$(CONFIG_RWNX_MON_DATA) += -DCONFIG_RWNX_MON_DATA
+ccflags-$(CONFIG_RWNX_MON_XMIT) += -DCONFIG_RWNX_MON_XMIT
+ccflags-$(CONFIG_RWNX_MON_RXFILTER) += -DCONFIG_RWNX_MON_RXFILTER
+
 ccflags-$(CONFIG_RWNX_BFMER) += -DCONFIG_RWNX_BFMER
 ccflags-$(CONFIG_RWNX_SPLIT_TX_BUF) += -DCONFIG_RWNX_SPLIT_TX_BUF
 ifeq ($(CONFIG_RWNX_SPLIT_TX_BUF), y)
@@ -241,15 +286,27 @@ ccflags-$(CONFIG_USE_P2P0) += -DCONFIG_USE_P2P0
 ccflags-$(CONFIG_FDRV_NO_REG_SDIO) += -DCONFIG_FDRV_NO_REG_SDIO
 ccflags-$(CONFIG_SCHED_SCAN) += -DCONFIG_SCHED_SCAN
 ccflags-$(CONFIG_OOB) += -DCONFIG_OOB
+ccflags-$(CONFIG_AICWF_LATENCY_MODE) += -DAICWF_LATENCY_MODE
 ccflags-$(CONFIG_USE_CUSTOMER_MAC) += -DCONFIG_USE_CUSTOMER_MAC
 ccflags-$(CONFIG_PREALLOC_TXQ) += -DCONFIG_PREALLOC_TXQ
 ccflags-$(CONFIG_DPD) += -DCONFIG_DPD
 ccflags-$(CONFIG_FORCE_DPD_CALIB) += -DCONFIG_FORCE_DPD_CALIB -DCONFIG_DPD
+ccflags-$(CONFIG_LOFT_CALIB) += -DCONFIG_LOFT_CALIB
 ccflags-$(CONFIG_FILTER_TCP_ACK) += -DCONFIG_FILTER_TCP_ACK
+ccflags-$(CONFIG_SDIO_BT) += -DCONFIG_SDIO_BT
 ccflags-$(CONFIG_RESV_MEM_SUPPORT) += -DCONFIG_RESV_MEM_SUPPORT
 ccflags-$(CONFIG_GKI) += -DCONFIG_GKI
 ccflags-$(CONFIG_TEMP_COMP) += -DCONFIG_TEMP_COMP
-
+ccflags-$(CONFIG_TEMP_CONTROL) += -DCONFIG_TEMP_CONTROL
+ccflags-$(CONFIG_POWER_LIMIT) += -DCONFIG_POWER_LIMIT
+ccflags-$(CONFIG_EXT_FEM_8800DCDW) += -DCONFIG_EXT_FEM_8800DCDW
+ccflags-$(CONFIG_MCC) += -DCONFIG_MCC
+ccflags-$(CONFIG_SHUTDOWN_CALLBACK) += -DCONFIG_SHUTDOWN_CALLBACK
+ccflags-$(CONFIG_FOR_IPCAM) += -DCONFIG_FOR_IPCAM
+ccflags-$(CONFIG_SDIO_ADMA) += -DCONFIG_SDIO_ADMA
+ccflags-$(CONFIG_BAND_STEERING) += -DCONFIG_BAND_STEERING
+ccflags-$(CONFIG_PRBREQ_REPORT) += -DCONFIG_PRBREQ_REPORT
+ccflags-$(CONFIG_WRITE_FILE_D80X2) += -DRF_WRITE_FILE
 
 ifeq ($(CONFIG_SDIO_SUPPORT), y)
 ccflags-y += -DAICWF_SDIO_SUPPORT
@@ -284,11 +341,18 @@ endif
 
 ccflags-$(CONFIG_RX_REORDER) += -DAICWF_RX_REORDER
 ccflags-$(CONFIG_ARP_OFFLOAD) += -DAICWF_ARP_OFFLOAD
-ccflags-$(CONFIG_RADAR_DETECT) += -DRADAR_OR_IR_DETECT
+ccflags-$(CONFIG_RADAR_OR_IR_DETECT) += -DCONFIG_RADAR_OR_IR_DETECT
 ccflags-$(CONFIG_DOWNLOAD_FW)  += -DCONFIG_DOWNLOAD_FW
 ccflags-$(CONFIG_RX_NETIF_RECV_SKB) += -DCONFIG_RX_NETIF_RECV_SKB
+ccflags-$(CONFIG_ONE_TXQ)  += -DCONFIG_ONE_TXQ
+ccflags-$(CONFIG_TX_NETIF_FLOWCTRL) += -DCONFIG_TX_NETIF_FLOWCTRL
+ccflags-$(CONFIG_APF) += -DCONFIG_APF
+ccflags-$(CONFIG_AUTO_POWERSAVE) += -DCONFIG_AUTO_POWERSAVE
 
-# Platform support list
+ccflags-y += -DAIC_TRACE_INCLUDE_PATH=$(src)
+MAKEFLAGS +=-j$(shell nproc)
+
+########## Platform support list ##########
 CONFIG_PLATFORM_ROCKCHIP ?= n
 CONFIG_PLATFORM_ROCKCHIP2 ?= n
 CONFIG_PLATFORM_ALLWINNER ?= n
@@ -296,32 +360,10 @@ CONFIG_PLATFORM_INGENIC_T20 ?= n
 CONFIG_PLATFORM_AMLOGIC ?= n
 CONFIG_PLATFORM_UBUNTU ?= y
 
-ccflags-y += -DAIC_TRACE_INCLUDE_PATH=$(src)
-
 ifeq ($(CONFIG_PLATFORM_ROCKCHIP), y)
-#KDIR ?= /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/kernel
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android7/RK3229_ANDROID7.1_v1.01_20170914/rk3229_Android7.1_v1.01_xml0914/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
-#KDIR  ?= /home/yaya/E/Rockchip/3399/rk3399-android-10/kernel
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3399/rk3399-android-10/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
-#KDIR  ?= /home/yaya/E/Rockchip/3288/Android10/kernel/kernel/
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3288/Android10/tool/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR  ?= /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/kernel
-#ARCH ?= arm
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3229/Android9/rk3229_android9.0_box/prebuilts/gcc/linux-x86/arm/gcc-linaro-6.3.1-2017.05-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-
-#KDIR ?= /home/yaya/E/Rockchip/3566/Android/kernel
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3566/Android/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
-#KDIR ?= /home/yaya/E/Rockchip/3328/Android9/SDK/kernel/
-#ARCH ?= arm64
-#CROSS_COMPILE ?= /home/yaya/E/Rockchip/3328/Android9/SDK/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
-#KDIR ?= /home/yaya/E/Rockchip/3566/oudu/kernel
-KDIR ?= ~/E/Rockchip/3566/Android11/rk3566_rk3568_android11_oranth/kernel
-#KDIR ?= /home/yaya/E/Rockchip/3566/shengteng/kernel
-ARCH ?= arm64
-CROSS_COMPILE ?= ~/E/Rockchip/3566/Android11/rk3566_rk3568_android11_oranth/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
+ARCH := arm64
+KDIR ?= /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/kernel
+CROSS_COMPILE := /home/yaya/E/Rockchip/3566/firefly/Android11.0/Firefly-RK356X_Android11.0_git_20210824/RK356X_Android11.0/prebuilts/gcc/linux-x86/aarch64/gcc-linaro-6.3.1-2017.05-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
 ccflags-$(CONFIG_PLATFORM_ROCKCHIP) += -DCONFIG_PLATFORM_ROCKCHIP
 ccflags-y += -DANDROID_PLATFORM
 endif
@@ -356,6 +398,7 @@ ccflags-y += -DANDROID_PLATFORM
 endif
 
 ifeq ($(CONFIG_PLATFORM_UBUNTU), y)
+ccflags-$(CONFIG_PLATFORM_UBUNTU) += -DCONFIG_PLATFORM_UBUNTU
 KDIR  ?= /lib/modules/$(shell uname -r)/build
 PWD   ?= $(shell pwd)
 KVER ?= $(shell uname -r)
@@ -363,6 +406,7 @@ MODDESTDIR ?= /lib/modules/$(KVER)/kernel/drivers/net/wireless/
 ARCH ?= x86_64
 CROSS_COMPILE ?=
 endif
+###########################################
 
 
 all: modules

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_br_ext.c

@@ -1,17 +1,21 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2017 Realtek Corporation.
+ *  Copyright (C) 2019-2021 Aicsemi Corporation
  *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
  *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
+ *  http://www.apache.org/licenses/LICENSE-2.0
  *
- *****************************************************************************/
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
 #define _AIC_BR_EXT_C_
 
 #ifdef __KERNEL__

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_br_ext.h

@@ -1,17 +1,21 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2017 Realtek Corporation.
+ *  Copyright (C) 2019-2021 Aicsemi Corporation
  *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
  *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
+ *  http://www.apache.org/licenses/LICENSE-2.0
  *
- *****************************************************************************/
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
 #ifndef _AIC_BR_EXT_H_
 #define _AIC_BR_EXT_H_
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_bsp_export.h

@@ -23,7 +23,7 @@ enum skb_buff_id {
 	AIC_RESV_MEM_TXDATA,
 };
 
-#ifdef CONFIG_DPD
+#if defined(CONFIG_DPD) || defined(CONFIG_LOFT_CALIB)
 typedef struct {
     uint32_t bit_mask[3];
     uint32_t reserved;
@@ -45,10 +45,16 @@ typedef struct {
 
 #define MEMBER_SIZE(type, member)   sizeof(((type *)0)->member)
 #define DPD_RESULT_SIZE_8800DC      sizeof(rf_misc_ram_lite_t)
+#endif
 
+#ifdef CONFIG_DPD
 extern rf_misc_ram_lite_t dpd_res;
 #endif
 
+#ifdef CONFIG_LOFT_CALIB
+extern rf_misc_ram_lite_t loft_res_local;
+#endif
+
 int aicbsp_set_subsys(int, int);
 int aicbsp_get_feature(struct aicbsp_feature_t *feature, char *fw_path);
 bool aicbsp_get_load_fw_in_fdrv(void);

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_btsdio.h

@@ -0,0 +1,554 @@
+#ifndef _AICWF_SDIO_BT_H_
+#define _AICWF_SDIO_BT_H_
+
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+#include <linux/skbuff.h>
+#include <linux/errno.h>
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/poll.h>
+
+#include <linux/version.h>
+#include <linux/pm_runtime.h>
+#include <linux/firmware.h>
+#include <linux/suspend.h>
+
+
+#ifdef CONFIG_PLATFORM_UBUNTU
+#define CONFIG_BLUEDROID        0 /* bleuz 0, bluedroid 1, lbh 2 */
+#else
+#define CONFIG_BLUEDROID        1 /* bleuz 0, bluedroid 1, lbh 2 */
+#endif
+/* #define HCI_VERSION_CODE KERNEL_VERSION(3, 14, 41) */
+#define HCI_VERSION_CODE LINUX_VERSION_CODE
+
+
+#define PRINT_CMD_EVENT         1
+#define PRINT_ACL_DATA          1
+#define PRINT_SCO_DATA          1
+
+#define AICBT_DBG_FLAG          1
+
+#if AICBT_DBG_FLAG
+#define AICBT_DBG(fmt, arg...) printk( "aic_btsdio: " fmt "\n" , ## arg)
+#else
+#define AICBT_DBG(fmt, arg...)
+#endif
+
+#define AICBT_INFO(fmt, arg...) printk("aic_btsdio: " fmt "\n" , ## arg)
+#define AICBT_WARN(fmt, arg...) printk("aic_btsdio: " fmt "\n" , ## arg)
+#define AICBT_ERR(fmt, arg...) printk("aic_btsdio: " fmt "\n" , ## arg)
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(3, 4, 0)
+#define GET_DRV_DATA(x)        hci_get_drvdata(x)
+#else
+#define GET_DRV_DATA(x)        x->driver_data
+#endif
+
+#if CONFIG_BLUEDROID
+struct btusb_data {
+    struct hci_dev       *hdev;
+    //struct usb_device    *udev;
+    //struct usb_interface *intf;
+    //struct usb_interface *isoc;
+
+    spinlock_t lock;
+
+    unsigned long flags;
+
+    struct work_struct work;
+    struct work_struct waker;
+
+    /*struct usb_anchor tx_anchor;
+    struct usb_anchor intr_anchor;
+    struct usb_anchor bulk_anchor;
+    struct usb_anchor isoc_anchor;
+    struct usb_anchor deferred;*/
+    int tx_in_flight;
+    spinlock_t txlock;
+	
+#if (CONFIG_BLUEDROID == 0)
+#if HCI_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
+		spinlock_t rxlock;
+		struct sk_buff *evt_skb;
+		struct sk_buff *acl_skb;
+		struct sk_buff *sco_skb;
+#endif
+#endif
+
+    /*struct usb_endpoint_descriptor *intr_ep;
+    struct usb_endpoint_descriptor *bulk_tx_ep;
+    struct usb_endpoint_descriptor *bulk_rx_ep;
+    struct usb_endpoint_descriptor *isoc_tx_ep;
+    struct usb_endpoint_descriptor *isoc_rx_ep;*/
+
+    __u8 cmdreq_type;
+
+    unsigned int sco_num;
+    int isoc_altsetting;
+    int suspend_count;
+    uint16_t sco_handle;
+
+#if (CONFIG_BLUEDROID == 0)
+#if HCI_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
+    int (*recv_bulk) (struct btusb_data * data, void *buffer, int count);
+#endif
+#endif
+
+//#ifdef CONFIG_HAS_EARLYSUSPEND
+#if 0
+    struct early_suspend early_suspend;
+#else
+    struct notifier_block pm_notifier;
+    struct notifier_block reboot_notifier;
+#endif
+    //firmware_info *fw_info;
+
+#ifdef CONFIG_SCO_OVER_HCI
+    AIC_sco_card_t  *pSCOSnd;
+#endif
+};
+
+
+
+#define QUEUE_SIZE 500
+
+/***************************************
+** AicSemi - Integrate from bluetooth.h **
+*****************************************/
+/* Reserv for core and drivers use */
+#define BT_SKB_RESERVE    8
+
+/* BD Address */
+typedef struct {
+    __u8 b[6];
+} __packed bdaddr_t;
+
+/* Skb helpers */
+struct bt_skb_cb {
+    __u8 pkt_type;
+    __u8 incoming;
+    __u16 expect;
+    __u16 tx_seq;
+    __u8 retries;
+    __u8 sar;
+    __u8 force_active;
+};
+
+#define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
+
+
+/***********************************
+** AicSemi - Integrate from hci.h **
+***********************************/
+#define HCI_MAX_ACL_SIZE    1024
+#define HCI_MAX_SCO_SIZE    255
+#define HCI_MAX_EVENT_SIZE    260
+#define HCI_MAX_FRAME_SIZE    (HCI_MAX_ACL_SIZE + 4)
+
+/* HCI bus types */
+#define HCI_VIRTUAL    0
+#define HCI_USB        1
+#define HCI_PCCARD    2
+#define HCI_UART    3
+#define HCI_RS232    4
+#define HCI_PCI        5
+#define HCI_SDIO    6
+
+/* HCI controller types */
+#define HCI_BREDR    0x00
+#define HCI_AMP        0x01
+
+/* HCI device flags */
+enum {
+    HCI_UP,
+    HCI_INIT,
+    HCI_RUNNING,
+
+    HCI_PSCAN,
+    HCI_ISCAN,
+    HCI_AUTH,
+    HCI_ENCRYPT,
+    HCI_INQUIRY,
+
+    HCI_RAW,
+
+    HCI_RESET,
+};
+
+/*
+ * BR/EDR and/or LE controller flags: the flags defined here should represent
+ * states from the controller.
+ */
+enum {
+    HCI_SETUP,
+    HCI_AUTO_OFF,
+    HCI_MGMT,
+    HCI_PAIRABLE,
+    HCI_SERVICE_CACHE,
+    HCI_LINK_KEYS,
+    HCI_DEBUG_KEYS,
+    HCI_UNREGISTER,
+
+    HCI_LE_SCAN,
+    HCI_SSP_ENABLED,
+    HCI_HS_ENABLED,
+    HCI_LE_ENABLED,
+    HCI_CONNECTABLE,
+    HCI_DISCOVERABLE,
+    HCI_LINK_SECURITY,
+    HCI_PENDING_CLASS,
+};
+
+/* HCI data types */
+#define HCI_COMMAND_PKT        0x01
+#define HCI_ACLDATA_PKT        0x02
+#define HCI_SCODATA_PKT        0x03
+#define HCI_EVENT_PKT        0x04
+#define HCI_VENDOR_PKT        0xff
+
+#define HCI_MAX_NAME_LENGTH        248
+#define HCI_MAX_EIR_LENGTH        240
+
+#define HCI_OP_READ_LOCAL_VERSION    0x1001
+struct hci_rp_read_local_version {
+    __u8     status;
+    __u8     hci_ver;
+    __le16   hci_rev;
+    __u8     lmp_ver;
+    __le16   manufacturer;
+    __le16   lmp_subver;
+} __packed;
+
+#define HCI_EV_CMD_COMPLETE        0x0e
+struct hci_ev_cmd_complete {
+    __u8     ncmd;
+    __le16   opcode;
+} __packed;
+
+/* ---- HCI Packet structures ---- */
+#define HCI_COMMAND_HDR_SIZE 3
+#define HCI_EVENT_HDR_SIZE   2
+#define HCI_ACL_HDR_SIZE     4
+#define HCI_SCO_HDR_SIZE     3
+
+struct hci_command_hdr {
+    __le16    opcode;        /* OCF & OGF */
+    __u8    plen;
+} __packed;
+
+struct hci_event_hdr {
+    __u8    evt;
+    __u8    plen;
+} __packed;
+
+struct hci_acl_hdr {
+    __le16    handle;        /* Handle & Flags(PB, BC) */
+    __le16    dlen;
+} __packed;
+
+struct hci_sco_hdr {
+    __le16    handle;
+    __u8    dlen;
+} __packed;
+
+static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
+{
+    return (struct hci_event_hdr *) skb->data;
+}
+
+static inline struct hci_acl_hdr *hci_acl_hdr(const struct sk_buff *skb)
+{
+    return (struct hci_acl_hdr *) skb->data;
+}
+
+static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
+{
+    return (struct hci_sco_hdr *) skb->data;
+}
+
+/* ---- HCI Ioctl requests structures ---- */
+struct hci_dev_stats {
+    __u32 err_rx;
+    __u32 err_tx;
+    __u32 cmd_tx;
+    __u32 evt_rx;
+    __u32 acl_tx;
+    __u32 acl_rx;
+    __u32 sco_tx;
+    __u32 sco_rx;
+    __u32 byte_rx;
+    __u32 byte_tx;
+};
+/* AicSemi - Integrate from hci.h end */
+
+/*****************************************
+** AicSemi - Integrate from hci_core.h  **
+*****************************************/
+struct hci_conn_hash {
+    struct list_head list;
+    unsigned int     acl_num;
+    unsigned int     sco_num;
+    unsigned int     le_num;
+};
+
+#define HCI_MAX_SHORT_NAME_LENGTH    10
+
+#define NUM_REASSEMBLY 4
+struct hci_dev {
+    struct mutex    lock;
+
+    char        name[8];
+    unsigned long    flags;
+    __u16        id;
+    __u8        bus;
+    __u8        dev_type;
+
+    struct sk_buff        *reassembly[NUM_REASSEMBLY];
+
+    struct hci_conn_hash    conn_hash;
+
+    struct hci_dev_stats    stat;
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(3, 4, 0)
+    atomic_t        refcnt;
+    struct module           *owner;
+    void                    *driver_data;
+#endif
+
+    atomic_t        promisc;
+
+    struct device        *parent;
+    struct device        dev;
+
+    unsigned long        dev_flags;
+
+    int (*open)(struct hci_dev *hdev);
+    int (*close)(struct hci_dev *hdev);
+    int (*flush)(struct hci_dev *hdev);
+    int (*send)(struct sk_buff *skb);
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(3, 4, 0)
+    void (*destruct)(struct hci_dev *hdev);
+#endif
+#if LINUX_VERSION_CODE > KERNEL_VERSION(3, 7, 1)
+    __u16               voice_setting;
+#endif
+    void (*notify)(struct hci_dev *hdev, unsigned int evt);
+    int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
+	u8 *align_data;
+};
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(3, 4, 0)
+static inline struct hci_dev *__hci_dev_hold(struct hci_dev *d)
+{
+    atomic_inc(&d->refcnt);
+    return d;
+}
+
+static inline void __hci_dev_put(struct hci_dev *d)
+{
+    if (atomic_dec_and_test(&d->refcnt))
+        d->destruct(d);
+}
+#endif
+
+static inline void *hci_get_drvdata(struct hci_dev *hdev)
+{
+    return dev_get_drvdata(&hdev->dev);
+}
+
+static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
+{
+    dev_set_drvdata(&hdev->dev, data);
+}
+
+#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->parent = (pdev))
+
+
+/* ---- HCI Packet structures ---- */
+#define HCI_COMMAND_HDR_SIZE 3
+#define HCI_EVENT_HDR_SIZE   2
+#define HCI_ACL_HDR_SIZE     4
+#define HCI_SCO_HDR_SIZE     3
+
+/* -----  HCI Commands ---- */
+#define HCI_OP_INQUIRY            0x0401
+#define HCI_OP_INQUIRY_CANCEL        0x0402
+#define HCI_OP_EXIT_PERIODIC_INQ    0x0404
+#define HCI_OP_CREATE_CONN        0x0405
+#define HCI_OP_DISCONNECT                0x0406
+#define HCI_OP_ADD_SCO            0x0407
+#define HCI_OP_CREATE_CONN_CANCEL    0x0408
+#define HCI_OP_ACCEPT_CONN_REQ        0x0409
+#define HCI_OP_REJECT_CONN_REQ        0x040a
+#define HCI_OP_LINK_KEY_REPLY        0x040b
+#define HCI_OP_LINK_KEY_NEG_REPLY    0x040c
+#define HCI_OP_PIN_CODE_REPLY        0x040d
+#define HCI_OP_PIN_CODE_NEG_REPLY    0x040e
+#define HCI_OP_CHANGE_CONN_PTYPE    0x040f
+#define HCI_OP_AUTH_REQUESTED        0x0411
+#define HCI_OP_SET_CONN_ENCRYPT        0x0413
+#define HCI_OP_CHANGE_CONN_LINK_KEY    0x0415
+#define HCI_OP_REMOTE_NAME_REQ        0x0419
+#define HCI_OP_REMOTE_NAME_REQ_CANCEL    0x041a
+#define HCI_OP_READ_REMOTE_FEATURES    0x041b
+#define HCI_OP_READ_REMOTE_EXT_FEATURES    0x041c
+#define HCI_OP_READ_REMOTE_VERSION    0x041d
+#define HCI_OP_SETUP_SYNC_CONN        0x0428
+#define HCI_OP_ACCEPT_SYNC_CONN_REQ    0x0429
+#define HCI_OP_REJECT_SYNC_CONN_REQ    0x042a
+#define HCI_OP_SNIFF_MODE        0x0803
+#define HCI_OP_EXIT_SNIFF_MODE        0x0804
+#define HCI_OP_ROLE_DISCOVERY        0x0809
+#define HCI_OP_SWITCH_ROLE        0x080b
+#define HCI_OP_READ_LINK_POLICY        0x080c
+#define HCI_OP_WRITE_LINK_POLICY    0x080d
+#define HCI_OP_READ_DEF_LINK_POLICY    0x080e
+#define HCI_OP_WRITE_DEF_LINK_POLICY    0x080f
+#define HCI_OP_SNIFF_SUBRATE        0x0811
+#define HCI_OP_Write_Link_Policy_Settings 0x080d
+#define HCI_OP_SET_EVENT_MASK        0x0c01
+#define HCI_OP_RESET            0x0c03
+#define HCI_OP_SET_EVENT_FLT        0x0c05
+#define HCI_OP_Write_Extended_Inquiry_Response        0x0c52
+#define HCI_OP_Write_Simple_Pairing_Mode 0x0c56
+#define HCI_OP_Read_Buffer_Size 0x1005
+#define HCI_OP_Host_Buffer_Size 0x0c33
+#define HCI_OP_Read_Local_Version_Information 0x1001
+#define HCI_OP_Read_BD_ADDR 0x1009
+#define HCI_OP_Read_Local_Supported_Commands 0x1002
+#define HCI_OP_Write_Scan_Enable 0x0c1a
+#define HCI_OP_Write_Current_IAC_LAP 0x0c3a
+#define HCI_OP_Write_Inquiry_Scan_Activity 0x0c1e
+#define HCI_OP_Write_Class_of_Device 0x0c24
+#define HCI_OP_LE_Rand 0x2018
+#define HCI_OP_LE_Set_Random_Address 0x2005
+#define HCI_OP_LE_Set_Extended_Scan_Enable 0x2042
+#define HCI_OP_LE_Set_Extended_Scan_Parameters 0x2041
+#define HCI_OP_Set_Event_Filter 0x0c05
+#define HCI_OP_Write_Voice_Setting 0x0c26
+#define HCI_OP_Change_Local_Name 0x0c13
+#define HCI_OP_Read_Local_Name 0x0c14
+#define HCI_OP_Wirte_Page_Timeout 0x0c18
+#define HCI_OP_LE_Clear_Resolving_List 0x0c29
+#define HCI_OP_LE_Set_Addres_Resolution_Enable_Command 0x0c2e
+#define HCI_OP_Write_Inquiry_mode 0x0c45
+#define HCI_OP_Write_Page_Scan_Type 0x0c47
+#define HCI_OP_Write_Inquiry_Scan_Type 0x0c43
+
+#define HCI_OP_Delete_Stored_Link_Key 0x0c12
+#define HCI_OP_LE_Read_Local_Resolvable_Address 0x202d
+#define HCI_OP_LE_Extended_Create_Connection 0x2043
+#define HCI_OP_Read_Remote_Version_Information 0x041d
+#define HCI_OP_LE_Start_Encryption 0x2019
+#define HCI_OP_LE_Add_Device_to_Resolving_List 0x2027
+#define HCI_OP_LE_Set_Privacy_Mode 0x204e
+#define HCI_OP_LE_Connection_Update 0x2013
+
+/* -----  HCI events---- */
+#define HCI_OP_DISCONNECT        0x0406
+#define HCI_EV_INQUIRY_COMPLETE        0x01
+#define HCI_EV_INQUIRY_RESULT        0x02
+#define HCI_EV_CONN_COMPLETE        0x03
+#define HCI_EV_CONN_REQUEST            0x04
+#define HCI_EV_DISCONN_COMPLETE        0x05
+#define HCI_EV_AUTH_COMPLETE        0x06
+#define HCI_EV_REMOTE_NAME            0x07
+#define HCI_EV_ENCRYPT_CHANGE        0x08
+#define HCI_EV_CHANGE_LINK_KEY_COMPLETE    0x09
+
+#define HCI_EV_REMOTE_FEATURES        0x0b
+#define HCI_EV_REMOTE_VERSION        0x0c
+#define HCI_EV_QOS_SETUP_COMPLETE    0x0d
+#define HCI_EV_CMD_COMPLETE            0x0e
+#define HCI_EV_CMD_STATUS            0x0f
+
+#define HCI_EV_ROLE_CHANGE            0x12
+#define HCI_EV_NUM_COMP_PKTS        0x13
+#define HCI_EV_MODE_CHANGE            0x14
+#define HCI_EV_PIN_CODE_REQ            0x16
+#define HCI_EV_LINK_KEY_REQ            0x17
+#define HCI_EV_LINK_KEY_NOTIFY        0x18
+#define HCI_EV_CLOCK_OFFSET            0x1c
+#define HCI_EV_PKT_TYPE_CHANGE        0x1d
+#define HCI_EV_PSCAN_REP_MODE        0x20
+
+#define HCI_EV_INQUIRY_RESULT_WITH_RSSI    0x22
+#define HCI_EV_REMOTE_EXT_FEATURES    0x23
+#define HCI_EV_SYNC_CONN_COMPLETE    0x2c
+#define HCI_EV_SYNC_CONN_CHANGED    0x2d
+#define HCI_EV_SNIFF_SUBRATE            0x2e
+#define HCI_EV_EXTENDED_INQUIRY_RESULT    0x2f
+#define HCI_EV_IO_CAPA_REQUEST        0x31
+#define HCI_EV_SIMPLE_PAIR_COMPLETE    0x36
+#define HCI_EV_REMOTE_HOST_FEATURES    0x3d
+#define HCI_EV_LE_Meta 0x3e
+
+/* ULP Event sub code */
+#define HCI_BLE_CONN_COMPLETE_EVT 0x01
+#define HCI_BLE_ADV_PKT_RPT_EVT 0x02
+#define HCI_BLE_LL_CONN_PARAM_UPD_EVT 0x03
+#define HCI_BLE_READ_REMOTE_FEAT_CMPL_EVT 0x04
+#define HCI_BLE_LTK_REQ_EVT 0x05
+#define HCI_BLE_RC_PARAM_REQ_EVT 0x06
+#define HCI_BLE_DATA_LENGTH_CHANGE_EVT 0x07
+#define HCI_BLE_ENHANCED_CONN_COMPLETE_EVT 0x0a
+#define HCI_BLE_DIRECT_ADV_EVT 0x0b
+#define HCI_BLE_PHY_UPDATE_COMPLETE_EVT 0x0c
+#define HCI_LE_EXTENDED_ADVERTISING_REPORT_EVT 0x0D
+#define HCI_BLE_PERIODIC_ADV_SYNC_EST_EVT      0x0E
+#define HCI_BLE_PERIODIC_ADV_REPORT_EVT        0x0F
+#define HCI_BLE_PERIODIC_ADV_SYNC_LOST_EVT     0x10
+#define HCI_BLE_SCAN_TIMEOUT_EVT               0x11
+#define HCI_LE_ADVERTISING_SET_TERMINATED_EVT 0x12
+#define HCI_BLE_SCAN_REQ_RX_EVT                0x13
+#define HCI_BLE_CIS_EST_EVT 0x19
+#define HCI_BLE_CIS_REQ_EVT 0x1a
+#define HCI_BLE_CREATE_BIG_CPL_EVT 0x1b
+#define HCI_BLE_TERM_BIG_CPL_EVT 0x1c
+#define HCI_BLE_BIG_SYNC_EST_EVT 0x1d
+#define HCI_BLE_BIG_SYNC_LOST_EVT 0x1e
+#define HCI_BLE_REQ_PEER_SCA_CPL_EVT 0x1f
+
+#define HCI_VENDOR_SPECIFIC_EVT 0xFF /* Vendor specific events */
+
+#define CONFIG_MAC_OFFSET_GEN_1_2       (0x3C)      //MAC's OFFSET in config/efuse for aic generation 1~2 bluetooth chip
+#define CONFIG_MAC_OFFSET_GEN_3PLUS     (0x44)      //MAC's OFFSET in config/efuse for aic generation 3+ bluetooth chip
+
+//Define ioctl cmd the same as HCIDEVUP in the kernel
+#define DOWN_FW_CFG             _IOW('E', 176, int)
+//#ifdef CONFIG_SCO_OVER_HCI
+//#define SET_ISO_CFG             _IOW('H', 202, int)
+//#else
+#define SET_ISO_CFG             _IOW('E', 177, int)
+//#endif
+#define RESET_CONTROLLER        _IOW('E', 178, int)
+#define DWFW_CMPLT              _IOW('E', 179, int)
+
+#define GET_USB_INFO            _IOR('E', 180, int)
+
+void bt_data_dump(char* tag, void* data, unsigned long len);
+int aic_enqueue(struct sk_buff *skb);
+int aic_queue_cnt(void);
+int bt_sdio_recv(u8 *data,u32 data_len);
+
+
+int btchr_init(void);
+void btchr_exit(void);
+int hdev_init(void);
+void hdev_exit(void);
+
+
+struct hci_dev *hci_dev_get(int index);
+int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count);
+#else
+int btsdio_init(void);
+void btsdio_remove(void);
+int bt_sdio_recv(u8 *data,u32 data_len);
+#endif
+#endif//_AICWF_SDIO_BT_H_
+

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_priv_cmd.h

@@ -0,0 +1,33 @@
+/**
+ ******************************************************************************
+ *
+ * @file private_cmd.h
+ *
+ * Copyright (C) Aicsemi 2018-2024
+ *
+ ******************************************************************************
+ */
+
+#ifndef _AIC_PRIV_CMD_H_
+#define _AIC_PRIV_CMD_H_
+
+#include "rwnx_defs.h"
+
+typedef struct _android_wifi_priv_cmd {
+    char *buf;
+    int used_len;
+    int total_len;
+} android_wifi_priv_cmd;
+
+#ifdef CONFIG_COMPAT
+typedef struct _compat_android_wifi_priv_cmd {
+    compat_caddr_t buf;
+    int used_len;
+    int total_len;
+} compat_android_wifi_priv_cmd;
+#endif /* CONFIG_COMPAT */
+
+int android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd);
+
+#endif /* _AIC_PRIV_CMD_H_ */
+

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_vendor.c

@@ -9,6 +9,7 @@
 #include <linux/rtnetlink.h>
 #include <net/netlink.h>
 #include "rwnx_version_gen.h"
+#include "rwnx_msg_tx.h"
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
 
@@ -27,6 +28,14 @@ static struct wifi_ring_buffer_status ring_buffer[] = {
 static struct wlan_driver_wake_reason_cnt_t wake_reason_cnt = {
 	.total_cmd_event_wake = 10,
 };
+
+#endif
+
+#ifdef CONFIG_APF
+#define AIC_APF_MEM_SIZE      2048
+#define AIC_APF_VERSION       4
+
+static char apfProgram[AIC_APF_MEM_SIZE];
 #endif
 
 int aic_dev_start_mkeep_alive(struct rwnx_hw *rwnx_hw, struct rwnx_vif *rwnx_vif,
@@ -305,17 +314,42 @@ out_put_fail:
 	return -EMSGSIZE;
 }
 
+struct ieee80211_regdomain *getRegdomainFromRwnxDB(struct wiphy *wiphy, char *alpha2);
+
 static int aicwf_vendor_subcmd_set_country_code(struct wiphy *wiphy, struct wireless_dev *wdev,
 	const void *data, int len)
 {
 	int ret = 0, rem, type;
 	const struct nlattr *iter;
+    struct ieee80211_regdomain *regdomain;
+    char *country = NULL;
+    struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
+
+	if (!rwnx_hw->mod_params->custregd) {
+		AICWFDBG(LOGERROR, "%s: invalid custregd\n", __func__);
+		return -EINVAL;
+	}
 
 	nla_for_each_attr(iter, data, len, rem) {
 		type = nla_type(iter);
 		switch (type) {
 		case ANDR_WIFI_ATTRIBUTE_COUNTRY:
 			printk("%s(%d), ANDR_WIFI_ATTRIBUTE_COUNTRY: %s\n", __func__, __LINE__, (char *)nla_data(iter));
+            country = (char *)nla_data(iter);
+            
+            AICWFDBG(LOGINFO, "%s country code:%c%c\n", __func__, 
+                country[0], 
+                country[1]);
+            
+            regdomain = getRegdomainFromRwnxDB(rwnx_hw->wiphy, country);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+            if((ret = regulatory_set_wiphy_regd(rwnx_hw->wiphy, regdomain))){
+                printk("regulatory_set_wiphy_regd fail \r\n");
+            }
+#else
+            wiphy_apply_custom_regulatory(rwnx_hw->wiphy, regdomain);
+#endif
+
 			break;
 		default:
 			pr_err("%s(%d), Unknown type: %d\n", __func__, __LINE__, type);
@@ -382,6 +416,9 @@ static int aicwf_vendor_subcmd_get_feature_set(struct wiphy *wiphy, struct wirel
 	/*bit 21:WiFi mkeep_alive*/
 	feature |= WIFI_FEATURE_MKEEP_ALIVE;
 
+#ifdef AICWF_LATENCY_MODE
+	feature |= WIFI_FEATURE_SET_LATENCY_MODE;
+#endif
 	if (nla_put_u32(reply, ANDR_WIFI_ATTRIBUTE_NUM_FEATURE_SET, feature)) {
 		wiphy_err(wiphy, "%s put u32 error\n", __func__);
 		goto out_put_fail;
@@ -578,7 +615,103 @@ out_put_fail:
 	return -EMSGSIZE;
 }
 
-static int aicwf_vendor_apf_subcmd_get_capabilities(struct wiphy *wiphy, struct wireless_dev *wdev,
+static int aicwf_vendor_logger_get_tx_pkt_fates(struct wiphy *wiphy, struct wireless_dev *wdev,
+	const void *data, int len)
+{
+#if 0
+	int ret = 0, rem, type;
+	const struct nlattr *iter;
+	int fate_num;
+	int fate_data;
+
+	AICWFDBG(LOGDEBUG, "%s Enter\r\n", __func__);
+	nla_for_each_attr(iter, data, len, rem) {
+		type = nla_type(iter);
+		switch (type) {
+		case LOGGER_ATTRIBUTE_PKT_FATE_NUM:
+			fate_num = nla_get_u32(iter);
+			break;
+		case LOGGER_ATTRIBUTE_PKT_FATE_DATA:
+			fate_data = nla_get_u64(iter);
+			break;
+		default:
+			AICWFDBG(LOGERROR, "%s(%d), Unknown type: %d\n", __func__, __LINE__, type);
+			return -EINVAL;
+		}
+	}
+#endif
+	/* TODO
+	 * Add handle in the future
+	 */
+	return 0;
+}
+
+static int aicwf_vendor_logger_get_rx_pkt_fates(struct wiphy *wiphy, struct wireless_dev *wdev,
+	const void *data, int len)
+{
+#if 0
+	int ret = 0, rem, type;
+	const struct nlattr *iter;
+	int fate_num;
+	int fate_data;
+
+	AICWFDBG(LOGDEBUG, "%s Enter\r\n", __func__);
+	nla_for_each_attr(iter, data, len, rem) {
+		type = nla_type(iter);
+		switch (type) {
+		case LOGGER_ATTRIBUTE_PKT_FATE_NUM:
+			fate_num = nla_get_u32(iter);
+			break;
+		case LOGGER_ATTRIBUTE_PKT_FATE_DATA:
+			fate_data = nla_get_u64(iter);
+			break;
+		default:
+			AICWFDBG(LOGERROR, "%s(%d), Unknown type: %d\n", __func__, __LINE__, type);
+			return -EINVAL;
+		}
+	}
+#endif
+	/* TODO
+	 * Add handle in the future
+	 */
+	return 0;
+}
+
+
+#ifdef AICWF_LATENCY_MODE
+static int aicwf_vendor_subcmd_set_latency_mode(struct wiphy *wiphy,
+	struct wireless_dev *wdev, const void *data, int len)
+{
+	int err = 0, rem, type;
+	u32 latency_mode;
+	const struct nlattr *iter;
+	struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
+
+	nla_for_each_attr(iter, data, len, rem) {
+		type = nla_type(iter);
+		switch (type) {
+		case ANDR_WIFI_ATTRIBUTE_LATENCY_MODE:
+			latency_mode = nla_get_u32(iter);
+			printk("%s,Setting latency mode %d\n", __func__, latency_mode);
+			#ifdef AICWF_SDIO_SUPPORT
+			if (latency_mode) {
+				rwnx_send_me_set_lp_level(rwnx_hw, 0, 1);
+			} else {
+				rwnx_send_me_set_lp_level(rwnx_hw, 1, 0);
+			}
+			#endif
+			break;
+		default:
+			pr_err("%s(%d), Unknown type: %d\n", __func__, __LINE__, type);
+			return err;
+		}
+	}
+
+	return err;
+}
+#endif
+
+static int aicwf_vendor_logger_start_pkt_fate_monitoring(struct wiphy *wiphy, struct wireless_dev *wdev,
 	const void *data, int len)
 {
 	/* TODO
@@ -587,6 +720,122 @@ static int aicwf_vendor_apf_subcmd_get_capabilities(struct wiphy *wiphy, struct
 	return 0;
 }
 
+#ifdef CONFIG_APF
+static int aicwf_vendor_apf_subcmd_get_capabilities(struct wiphy *wiphy, struct wireless_dev *wdev,
+	const void *data, int len)
+{
+	int ret;
+	struct sk_buff *reply;
+	uint32_t payload;
+	printk("%s\n", __func__);
+
+	/* APF_ATTRIBUTE_VERSION + APF_ATTRIBUTE_MAX_LEN */
+	payload = sizeof(u32) * 2;
+	reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
+
+	if (!reply)
+		return -ENOMEM;
+
+	if (nla_put_u32(reply, APF_ATTRIBUTE_VERSION, AIC_APF_VERSION))
+		goto out_put_fail;
+
+	if (nla_put_u32(reply, APF_ATTRIBUTE_MAX_LEN, AIC_APF_MEM_SIZE))
+		goto out_put_fail;
+
+	ret = cfg80211_vendor_cmd_reply(reply);
+	if (ret)
+		wiphy_err(wiphy, "reply cmd error\n");
+
+	return ret;
+
+out_put_fail:
+	kfree_skb(reply);
+	return -EMSGSIZE;
+}
+
+static int aicwf_vendor_apf_set_filter(struct wiphy *wiphy, struct wireless_dev *wdev,
+	const void *data, int len)
+{
+	int ret = 0, rem, type;
+	const struct nlattr *iter;
+	unsigned int mProgramLen = 0;
+	struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
+
+	printk("%s\n", __func__);
+
+	nla_for_each_attr(iter, data, len, rem) {
+		type = nla_type(iter);
+		switch (type) {
+		case APF_ATTRIBUTE_PROGRAM_LEN:
+			memcpy(&mProgramLen, nla_data(iter), sizeof(unsigned int));
+			ret = (mProgramLen > 0 && mProgramLen <= AIC_APF_MEM_SIZE) ? 0 : -EINVAL;
+			break;
+		case APF_ATTRIBUTE_PROGRAM:
+			if (mProgramLen > AIC_APF_MEM_SIZE || mProgramLen == 0) {
+				printk("%s: apf program size invalid: %d (should > 0 and <= %d)\n",
+						__func__, mProgramLen, AIC_APF_MEM_SIZE);
+				return -EINVAL;
+			}
+
+			memcpy(apfProgram, nla_data(iter), mProgramLen);
+			ret = rwnx_send_set_apf_prog_req(rwnx_hw, apfProgram, mProgramLen);
+			break;
+		default:
+			pr_err("%s(%d), Unknown type: %d\n", __func__, __LINE__, type);
+			return -EINVAL;
+		}
+	}
+
+	return ret;
+}
+
+static int aicwf_vendor_apf_read_filter_data(struct wiphy *wiphy,
+	struct wireless_dev *wdev, const void *data, int len)
+{
+	struct sk_buff *reply;
+	int ret, payload, apf_mem_size;
+	struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
+
+	printk("%s\n", __func__);
+
+	apf_mem_size = AIC_APF_MEM_SIZE;
+	payload = sizeof(u32) + apf_mem_size;
+
+	ret = rwnx_send_get_apf_prog_req(rwnx_hw, apfProgram, apf_mem_size);
+	if (ret != 0) {
+		pr_err("%s, Failed to read apf mem from firmware, ret = %d\n", __func__, ret);
+		return ret;
+	}
+
+	reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
+	if (!reply)
+		return -ENOMEM;
+
+	ret = nla_put_u32(reply, APF_ATTRIBUTE_PROGRAM_LEN, apf_mem_size);
+	if (ret < 0) {
+		pr_err("%s, Failed to put APF_ATTRIBUTE_MAX_LEN, ret = %d\n", __func__, ret);
+		goto out_put_fail;
+	}
+
+	/* copy the full apf mem */
+	ret = nla_put(reply, APF_ATTRIBUTE_PROGRAM, apf_mem_size, &apfProgram[0]);
+	if (ret < 0) {
+		pr_err("%s, Failed to put APF_ATTRIBUTE_PROGRAM, ret = %d\n", __func__, ret);
+		goto out_put_fail;
+	}
+
+	ret = cfg80211_vendor_cmd_reply(reply);
+	if (ret)
+		wiphy_err(wiphy, "reply cmd error\n");
+
+	return ret;
+
+out_put_fail:
+	kfree_skb(reply);
+	return -EMSGSIZE;
+}
+#endif
+
 static int aicwf_vendor_sub_cmd_set_mac(struct wiphy *wiphy, struct wireless_dev *wdev,
 	const void *data, int len)
 {
@@ -641,6 +890,17 @@ aicwf_cfg80211_logger_policy[LOGGER_ATTRIBUTE_MAX + 1] = {
 	[LOGGER_ATTRIBUTE_RING_NAME] = { .type = NLA_STRING },
 };
 
+#ifdef CONFIG_APF
+static const struct nla_policy
+aicwf_cfg80211_apf_policy[APF_ATTRIBUTE_MAX + 1] = {
+	[0] = {.type = NLA_UNSPEC },
+	[APF_ATTRIBUTE_VERSION] = {.type = NLA_U32 },
+	[APF_ATTRIBUTE_MAX_LEN] = {.type = NLA_U32 },
+	[APF_ATTRIBUTE_PROGRAM] = { .type = NLA_BINARY },
+	[APF_ATTRIBUTE_PROGRAM_LEN] = { .type = NLA_U32 },
+};
+#endif
+
 static const struct nla_policy
 aicwf_cfg80211_subcmd_policy[GSCAN_ATTRIBUTE_MAX + 1] = {
 	[0] = {.type = NLA_UNSPEC },
@@ -845,6 +1105,7 @@ const struct wiphy_vendor_command aicwf_vendor_cmd[] = {
 		.policy = VENDOR_CMD_RAW_DATA,
 #endif
 	},
+#ifdef CONFIG_APF
 	{
 		{
 			.vendor_id = GOOGLE_OUI,
@@ -855,6 +1116,74 @@ const struct wiphy_vendor_command aicwf_vendor_cmd[] = {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
 		.dumpit = aicwf_dump_interface,
 #endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+		.policy = aicwf_cfg80211_apf_policy,
+		.maxattr = APF_ATTRIBUTE_MAX,
+#endif
+	},
+	{
+		{
+			.vendor_id = GOOGLE_OUI,
+			.subcmd = APF_SUBCMD_SET_FILTER
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = aicwf_vendor_apf_set_filter,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+		.policy = aicwf_cfg80211_apf_policy,
+		.maxattr = APF_ATTRIBUTE_MAX,
+#endif
+	},
+	{
+		{
+			.vendor_id = GOOGLE_OUI,
+			.subcmd = APF_SUBCMD_READ_FILTER_DATA
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = aicwf_vendor_apf_read_filter_data,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+		.policy = aicwf_cfg80211_apf_policy,
+		.maxattr = APF_ATTRIBUTE_MAX
+#endif /* LINUX_VERSION >= 5.3 */
+	},
+#endif
+	{
+		{
+			.vendor_id = GOOGLE_OUI,
+			.subcmd = LOGGER_START_PKT_FATE_MONITORING
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |  WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = aicwf_vendor_logger_start_pkt_fate_monitoring,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
+		.dumpit = aicwf_dump_interface,
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+		.policy = VENDOR_CMD_RAW_DATA,
+#endif
+	},
+	{
+		{
+			.vendor_id = GOOGLE_OUI,
+			.subcmd = LOGGER_GET_TX_PKT_FATES
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |  WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = aicwf_vendor_logger_get_tx_pkt_fates,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
+		.dumpit = aicwf_dump_interface,
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+		.policy = VENDOR_CMD_RAW_DATA,
+#endif
+	},
+	{
+		{
+			.vendor_id = GOOGLE_OUI,
+			.subcmd = LOGGER_GET_RX_PKT_FATES
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |  WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = aicwf_vendor_logger_get_rx_pkt_fates,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
+		.dumpit = aicwf_dump_interface,
+#endif
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
 		.policy = VENDOR_CMD_RAW_DATA,
 #endif
@@ -889,6 +1218,20 @@ const struct wiphy_vendor_command aicwf_vendor_cmd[] = {
         .maxattr = WIFI_VENDOR_ATTR_DRIVER_MAX,
 #endif
     	},
+#ifdef AICWF_LATENCY_MODE
+	{
+		{
+			.vendor_id = GOOGLE_OUI,
+			.subcmd = WIFI_SUBCMD_SET_LATENCY_MODE
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = aicwf_vendor_subcmd_set_latency_mode,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+		.policy = aicwf_cfg80211_andr_wifi_policy,
+		.maxattr = ANDR_WIFI_ATTRIBUTE_MAX
+#endif /* LINUX_VERSION >= 5.3 */
+	},
+#endif
 };
 #endif
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aic_vendor.h

@@ -117,6 +117,17 @@ enum logger_attributes {
 	LOGGER_ATTRIBUTE_MAX = LOGGER_ATTRIBUTE_AFTER_LAST - 1,
 };
 
+#ifdef CONFIG_APF
+enum wifi_apf_attr {
+	APF_ATTRIBUTE_VERSION,
+	APF_ATTRIBUTE_MAX_LEN,
+	APF_ATTRIBUTE_PROGRAM,
+	APF_ATTRIBUTE_PROGRAM_LEN,
+	APF_ATTRIBUTE_LAST,
+	APF_ATTRIBUTE_MAX = APF_ATTRIBUTE_LAST - 1,
+};
+#endif
+
 enum wifi_sub_command {
 	GSCAN_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START,
 	GSCAN_SUBCMD_SET_CONFIG,                            /* 0x1001 */
@@ -143,10 +154,14 @@ enum wifi_sub_command {
 	GSCAN_SUBCMD_ANQPO_CONFIG,                          /* 0x1015 */
 	WIFI_SUBCMD_SET_RSSI_MONITOR,                       /* 0x1016 */
 	WIFI_SUBCMD_CONFIG_ND_OFFLOAD,                      /* 0x1017 */
+	WIFI_SUBCMD_SET_LATENCY_MODE,                       /* 0x1018 */
 	/* Add more sub commands here */
 	GSCAN_SUBCMD_MAX,
 	APF_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_START,
 	APF_SUBCMD_SET_FILTER,
+#ifdef CONFIG_APF
+	APF_SUBCMD_READ_FILTER_DATA,
+#endif
 };
 
 enum gscan_attributes {
@@ -190,6 +205,7 @@ enum andr_wifi_attributes {
 	ANDR_WIFI_ATTRIBUTE_NODFS_SET,
 	ANDR_WIFI_ATTRIBUTE_COUNTRY,
 	ANDR_WIFI_ATTRIBUTE_ND_OFFLOAD_VALUE,
+	ANDR_WIFI_ATTRIBUTE_LATENCY_MODE,
 	// Add more attribute here
 	ANDR_WIFI_ATTRIBUTE_AFTER_LAST,
 	ANDR_WIFI_ATTRIBUTE_MAX = ANDR_WIFI_ATTRIBUTE_AFTER_LAST - 1,
@@ -223,6 +239,7 @@ enum wifi_support_feature {
 	WIFI_FEATURE_CONTROL_ROAMING    = 0x800000,    /* Enable/Disable firmware roaming  */
 	WIFI_FEATURE_IE_WHITELIST       = 0x1000000,   /* Support Probe IE white listing   */
 	WIFI_FEATURE_SCAN_RAND          = 0x2000000,   /* Support MAC & Probe Sequence Number randomization */
+	WIFI_FEATURE_SET_LATENCY_MODE   = 0x40000000,  /* Support Latency mode setting     */
 	WIFI_FEATURE_INVALID            = 0xFFFFFFFF,  /* Invalid Feature                  */
 };
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_compat_8800d80.c

@@ -4,11 +4,15 @@
 #include "aicwf_compat_8800d80.h"
 
 #define FW_USERCONFIG_NAME_8800D80         "aic_userconfig_8800d80.txt"
+#define FW_USERCONFIG_NAME_8800D80X2       "aic_userconfig_8800d80x2.txt"
+#define FW_POWERLIMIT_NAME_8800D80         "aic_powerlimit_8800d80.txt"
+
 
 int rwnx_request_firmware_common(struct rwnx_hw *rwnx_hw,
 	u32** buffer, const char *filename);
 void rwnx_plat_userconfig_parsing2(char *buffer, int size);
 void rwnx_plat_userconfig_parsing3(char *buffer, int size);
+void rwnx_plat_userconfig_parsing_8800d80x2(char *buffer, int size);
 
 void rwnx_release_firmware_common(u32** buffer);
 
@@ -16,15 +20,28 @@ int aicwf_set_rf_config_8800d80(struct rwnx_hw *rwnx_hw, struct mm_set_rf_calib_
 {
 	int ret = 0;
 
-	if ((ret = rwnx_send_txpwr_lvl_v3_req(rwnx_hw))) {
+	if(rwnx_hw->sdiodev->chipid == PRODUCT_ID_AIC8800D80){
+		if ((ret = rwnx_send_txpwr_lvl_v3_req(rwnx_hw))) {
+			return -1;
+		}
+
+		if ((ret = rwnx_send_txpwr_ofst2x_req(rwnx_hw))) {
+			return -1;
+		}
+	}else if(rwnx_hw->sdiodev->chipid == PRODUCT_ID_AIC8800D80X2){
+		if ((ret = rwnx_send_txpwr_lvl_v4_req(rwnx_hw))) {
+			return -1;
+		}
+		if ((ret = rwnx_send_txpwr_ofst2x_v2_req(rwnx_hw))) {
+			return -1;
+		}
+	}
+
+	if ((ret = rwnx_send_txpwr_lvl_adj_req(rwnx_hw))) {
 		return -1;
 	}
 
-	if ((ret = rwnx_send_txpwr_ofst2x_req(rwnx_hw))) {
-		return -1;
-	}
-
-        if ((ret = rwnx_send_rf_calib_req(rwnx_hw, cfm))) {
+    if ((ret = rwnx_send_rf_calib_req(rwnx_hw, cfm))) {
 		return -1;
 	}
 
@@ -59,4 +76,91 @@ int	rwnx_plat_userconfig_load_8800d80(struct rwnx_hw *rwnx_hw)
 
 }
 
+int	rwnx_plat_userconfig_load_8800d80x2(struct rwnx_hw *rwnx_hw)
+{
+    int size;
+    u32 *dst=NULL;
+    char *filename = FW_USERCONFIG_NAME_8800D80X2;
+
+    AICWFDBG(LOGINFO, "userconfig file path:%s \r\n", filename);
+
+    /* load file */
+    size = rwnx_request_firmware_common(rwnx_hw, &dst, filename);
+    if (size <= 0) {
+            AICWFDBG(LOGERROR, "wrong size of firmware file\n");
+            dst = NULL;
+            return 0;
+    }
+
+	/* Copy the file on the Embedded side */
+    AICWFDBG(LOGINFO, "### Load file done: %s, size=%d\n", filename, size);
+
+	rwnx_plat_userconfig_parsing_8800d80x2((char *)dst, size);
+
+    rwnx_release_firmware_common(&dst);
+
+    AICWFDBG(LOGINFO, "userconfig download complete\n\n");
+    return 0;
+
+}
+
+#ifdef CONFIG_POWER_LIMIT
+extern char country_code[4];
+int rwnx_plat_powerlimit_load_8800d80(struct rwnx_hw *rwnx_hw)
+{
+	int size;
+	u32 *dst = NULL;
+	char *filename = FW_POWERLIMIT_NAME_8800D80;
+
+	AICWFDBG(LOGDEBUG, "powerlimit file path:%s \r\n", filename);
+
+	/* load file */
+	size = rwnx_request_firmware_common(rwnx_hw, &dst, filename);
+	if (size <= 0) {
+		AICWFDBG(LOGERROR, "wrong size of cfg file\n");
+		dst = NULL;
+		return 0;
+	}
+
+	AICWFDBG(LOGDEBUG, "### Load file done: %s, size=%d\n", filename, size);
+
+	/* parsing the file */
+	rwnx_plat_powerlimit_parsing((char *)dst, size);
+
+	rwnx_release_firmware_common(&dst);
+
+	AICWFDBG(LOGDEBUG, "powerlimit download complete\n\n");
+	return 0;
+}
+
+int rwnx_plat_powerlimit_load_8800d80x2(struct rwnx_hw *rwnx_hw)
+{
+	int size;
+	u32 *dst = NULL;
+	char *filename = FW_POWERLIMIT_NAME_8800D80;
+
+	AICWFDBG(LOGDEBUG, "powerlimit file path:%s \r\n", filename);
+
+	/* load file */
+	size = rwnx_request_firmware_common(rwnx_hw, &dst, filename);
+	if (size <= 0) {
+		AICWFDBG(LOGERROR, "wrong size of cfg file\n");
+		dst = NULL;
+		return 0;
+	}
+
+	AICWFDBG(LOGDEBUG, "### Load file done: %s, size=%d\n", filename, size);
+
+	/* parsing the file */
+	rwnx_plat_powerlimit_parsing((char *)dst, size);
+
+	rwnx_release_firmware_common(&dst);
+
+	AICWFDBG(LOGDEBUG, "powerlimit download complete\n\n");
+	return 0;
+}
+
+#endif
+
+
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_compat_8800d80.h

@@ -4,6 +4,12 @@
 
 int aicwf_set_rf_config_8800d80(struct rwnx_hw *rwnx_hw, struct mm_set_rf_calib_cfm *cfm);
 int	rwnx_plat_userconfig_load_8800d80(struct rwnx_hw *rwnx_hw);
+int	rwnx_plat_userconfig_load_8800d80x2(struct rwnx_hw *rwnx_hw);
+
+#ifdef CONFIG_POWER_LIMIT
+int rwnx_plat_powerlimit_load_8800d80(struct rwnx_hw *rwnx_hw);
+int rwnx_plat_powerlimit_load_8800d80x2(struct rwnx_hw *rwnx_hw);
+#endif
 
 #endif
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_compat_8800dc.c

@@ -16,6 +16,7 @@ void rwnx_plat_userconfig_parsing2(char *buffer, int size);
 
 void rwnx_release_firmware_common(u32** buffer);
 
+#if !defined(CONFIG_EXT_FEM_8800DCDW)
 u32 wifi_txgain_table_24g_8800dcdw[32] =
 {
     0xA4B22189, //index 0
@@ -160,6 +161,80 @@ u32 wifi_txgain_table_24g_1_8800dcdw_h[32] =
     0x00001825,
 };
 
+#else /* #ifdef CONFIG_EXT_FEM_8800DCDW */
+// ofdm
+uint32_t wifi_txgain_table_24g_8800dcdw_femkct[32] = {
+    0x919221C2, //index 0
+    0x00007825,
+    0x899221C3, //index 1
+    0x00007825,
+    0x8B9221C3, //index 2
+    0x00007825,
+    0x929221C3, //index 3
+    0x00007825,
+    0x949221C4, //index 4
+    0x00007825,
+    0x969221C4, //index 5
+    0x00007825,
+    0x949221C6, //index 6
+    0x00007825,
+    0x949221C8, //index 7
+    0x00007825,
+    0x9C9221C8, //index 8
+    0x00007825,
+    0x9C9221CA, //index 9
+    0x00007825,
+    0x9C9221CB, //index 10
+    0x00007825,
+    0x939221D5, //index 11
+    0x00007825,
+    0x9B9221D7, //index 12
+    0x00007825,
+    0xA49221D7, //index 13
+    0x00007825,
+    0xA79221D7, //index 14
+    0x00007825,
+    0xBD9221D7, //index 15
+    0x00007825,
+};
+
+// 11b
+uint32_t wifi_txgain_table_24g_1_8800dcdw_femkct[32] = {
+    0x836E20C2, //index 0
+    0x00003024,
+    0x856E20C2, //index 1
+    0x00003024,
+    0x826E20C3, //index 2
+    0x00003024,
+    0x836E20C3, //index 3
+    0x00003024,
+    0x856E20C3, //index 4
+    0x00003024,
+    0x876E20C3, //index 5
+    0x00003024,
+    0x8B6E20C3, //index 6
+    0x00003024,
+    0x926E20C4, //index 7
+    0x00003024,
+    0x9A6E20C4, //index 8
+    0x00003024,
+    0x936E20C5, //index 9
+    0x00003024,
+    0x936E20C7, //index 10
+    0x00003024,
+    0xA16E20C8, //index 11
+    0x00003024,
+    0xA16E20CA, //index 12
+    0x00003024,
+    0xA26E20CB, //index 13
+    0x00003024,
+    0xAA6E20CD, //index 14
+    0x00003024,
+    0xAC7220CF, //index 15
+    0x00003024,
+};
+#endif
+
 u32 wifi_rxgain_table_24g_20m_8800dcdw[64] = {
     0x82f282d1,//index 0
     0x9591a324,
@@ -378,6 +453,53 @@ int aicwf_fdrv_dpd_result_load_8800dc(struct rwnx_hw *rwnx_hw, rf_misc_ram_lite_
 #endif
 #endif
 
+#if defined(CONFIG_LOFT_CALIB)
+extern rf_misc_ram_lite_t loft_res_local;
+
+int aicwf_fdrv_loft_result_apply_8800dc(struct rwnx_hw *rwnx_hw, rf_misc_ram_lite_t *loft_res)
+{
+    int ret = 0;
+    uint32_t cfg_base = 0x10164;
+    struct dbg_mem_read_cfm cfm;
+    uint32_t misc_ram_addr;
+    uint32_t ram_base_addr, ram_byte_cnt;
+    AICWFDBG(LOGINFO, "bit_mask[1]=%x\n", loft_res->bit_mask[1]);
+    if (loft_res->bit_mask[1] == 0) {
+        AICWFDBG(LOGERROR, "void loft_res, bypass it.\n");
+        return 0;
+    }
+    if (testmode == 1) {
+        cfg_base = RAM_LMAC_FW_ADDR + 0x0164;
+    }
+    if ((ret = rwnx_send_dbg_mem_read_req(rwnx_hw, cfg_base + 0x14, &cfm))) {
+        AICWFDBG(LOGERROR, "rf misc ram[0x%x] rd fail: %d\n", cfg_base + 0x14, ret);
+        return ret;
+    }
+    misc_ram_addr = cfm.memdata;
+    AICWFDBG(LOGINFO, "misc_ram_addr: %x\n", misc_ram_addr);
+    /* Copy loft_res on the Embedded side */
+    // bit_mask
+    AICWFDBG(LOGINFO, "bit_mask[0]=%x\n", loft_res->bit_mask[0]);
+    ram_base_addr = misc_ram_addr + offsetof(rf_misc_ram_t, bit_mask);
+    ram_byte_cnt = MEMBER_SIZE(rf_misc_ram_t, bit_mask) + MEMBER_SIZE(rf_misc_ram_t, reserved);
+    ret = rwnx_send_dbg_mem_block_write_req(rwnx_hw, ram_base_addr, ram_byte_cnt, (u32 *)&loft_res->bit_mask[0]);
+    if (ret) {
+        AICWFDBG(LOGERROR, "bit_mask wr fail: %x, ret:%d\r\n", ram_base_addr, ret);
+        return ret;
+    }
+    // loft_res
+    AICWFDBG(LOGINFO, "loft_res[0]=%x\n", loft_res->loft_res[0]);
+    ram_base_addr = misc_ram_addr + offsetof(rf_misc_ram_t, loft_res);
+    ram_byte_cnt = MEMBER_SIZE(rf_misc_ram_t, loft_res);
+    ret = rwnx_send_dbg_mem_block_write_req(rwnx_hw, ram_base_addr, ram_byte_cnt, (u32 *)&loft_res->loft_res[0]);
+    if (ret) {
+        AICWFDBG(LOGERROR, "loft_res wr fail: %x, ret:%d\r\n", ram_base_addr, ret);
+        return ret;
+    }
+    return ret;
+}
+#endif
+
 int aicwf_fdrv_misc_ram_init_8800dc(struct rwnx_hw *rwnx_hw)
 {
     int ret = 0;
@@ -423,6 +545,7 @@ int aicwf_set_rf_config_8800dc(struct rwnx_hw *rwnx_hw, struct mm_set_rf_calib_c
 
 
 	if (testmode == 0) {
+        #if !defined(CONFIG_EXT_FEM_8800DCDW)
         if (IS_CHIP_ID_H()) {
             if ((ret = rwnx_send_rf_config_req(rwnx_hw, 0,    1, (u8_l *)wifi_txgain_table_24g_8800dcdw_h, 128)))
                 return -1;
@@ -436,6 +559,18 @@ int aicwf_set_rf_config_8800dc(struct rwnx_hw *rwnx_hw, struct mm_set_rf_calib_c
             if ((ret = rwnx_send_rf_config_req(rwnx_hw, 16,    1, (u8_l *)wifi_txgain_table_24g_1_8800dcdw, 128)))
                 return -1;
         }
+        #else /* #ifdef CONFIG_EXT_FEM_8800DCDW */
+        {
+            ret = rwnx_send_rf_config_req(rwnx_hw, 0,    1, (u8_l *)wifi_txgain_table_24g_8800dcdw_femkct, 128);
+            if (ret) {
+                return -1;
+            }
+            ret = rwnx_send_rf_config_req(rwnx_hw, 16,    1, (u8_l *)wifi_txgain_table_24g_1_8800dcdw_femkct, 128);
+            if (ret) {
+                return -1;
+            }
+        }
+        #endif
 
 		if ((ret = rwnx_send_rf_config_req(rwnx_hw, 0,	0, (u8_l *)wifi_rxgain_table_24g_20m_8800dcdw, 256)))
 			return -1;
@@ -466,6 +601,14 @@ int aicwf_set_rf_config_8800dc(struct rwnx_hw *rwnx_hw, struct mm_set_rf_calib_c
                     return ret;
                 }
             }
+            #elif defined(CONFIG_LOFT_CALIB)
+            if (loft_res_local.bit_mask[1]) {
+                ret = aicwf_fdrv_loft_result_apply_8800dc(rwnx_hw, &loft_res_local);
+                if (ret) {
+                    AICWFDBG(LOGINFO, "apply loft res fail: %d\n", ret);
+                    return ret;
+                }
+            }
             #else
             {
                 ret = aicwf_fdrv_misc_ram_init_8800dc(rwnx_hw);

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_debug.h

@@ -10,10 +10,12 @@
 #define LOGTRACE		0x0004
 #define LOGDEBUG		0x0008
 #define LOGDATA			0x0010
-#define LOGIRQ			0x0020
+#define LOGSTEER		0x0020
 #define LOGSDPWRC		0x0040
 #define LOGWAKELOCK		0x0080
 #define LOGRXPOLL		0x0100
+#define LOGIRQ			0x0200
+#define LOGFW			0x0400
 
 extern int aicwf_dbg_level;
 void rwnx_data_dump(char* tag, void* data, unsigned long len);

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_manager.c

@@ -0,0 +1,601 @@
+/**
+ ******************************************************************************
+ *
+ * Copyright (C) 2020 AIC semiconductor.
+ *
+ * @file aicwf_manager.c
+ *
+ * @brief netlink msg definitions
+ *
+ ******************************************************************************
+ */
+
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <net/sock.h>
+#include "aicwf_manager.h"
+#include "lmac_mac.h"
+#include "aicwf_debug.h"
+
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG(x) ((u8_l *)(x))[0], ((u8_l *)(x))[1], ((u8_l *)(x))[2], ((u8_l *)(x))[3], ((u8_l *)(x))[4], ((u8_l *)(x))[5]
+#define MANAGER_STR "[MANAGER] SDIO "
+
+
+static struct sock *nl_sock = NULL;
+
+static struct rwnx_vif *nl_rwnx_vif[PHY_BAND_MAX][CONFIG_IFACE_NUMBER] = {{NULL}};
+static u8_l nl_hook[PHY_BAND_MAX][CONFIG_IFACE_NUMBER] = {{0}};
+
+static u8_l nl_daemon_on = 0;
+
+#define FREQ_2G_MIN 2412
+#define FREQ_2G_MAX 2484
+#define FREQ_5G_MIN 5170
+#define FREQ_5G_MAX 5825
+#define FREQ_6G_MIN 5925
+#define FREQ_6G_MAX 7125
+
+static int freq_to_channel(int freq)
+{
+	if (freq >= FREQ_2G_MIN && freq <= FREQ_2G_MAX) {
+		if (freq == 2484) {
+			return 14;
+		} else {
+			return (freq - 2412) / 5 + 1;
+		}
+	} else if (freq >= FREQ_5G_MIN && freq <= FREQ_5G_MAX) {
+		return (freq - 5000) / 5;
+	} else if (freq >= FREQ_6G_MIN && freq <= FREQ_6G_MAX) {
+		return (freq - 5950) / 5;
+	} else {
+		AICWFDBG(LOGERROR, MANAGER_STR"Unsupported frequency: %d MHz\n", freq);
+		return -1;
+	}
+}
+
+
+void aicwf_nl_recv_msg(struct sk_buff *skb)
+{
+	struct rwnx_vif *rwnx_vif;
+	struct rwnx_sta *sta = NULL;
+	u8_l rwnx_hook = 0;
+	u8_l band;
+	u8_l ssid;
+	struct nlmsghdr *nlh = NULL;
+	struct b_nl_message *msg = NULL;
+	struct b_elm_header *hdr = NULL;
+	struct b_elm_intf *intf = NULL;
+	struct b_elm_sta_info *sta_info = NULL;
+	struct b_elm_roam_info *roam_info = NULL;
+	u32 offset = 0;
+
+	if (skb == NULL) {
+		AICWFDBG(LOGERROR, MANAGER_STR"skb is null.\n");
+		return;
+	}
+
+	nlh = (struct nlmsghdr *)skb->data;
+	msg = (struct b_nl_message *)NLMSG_DATA(nlh);
+
+	AICWFDBG(LOGSTEER, MANAGER_STR"%s, %d\n", __func__, msg->type);
+
+	/* message type */
+	switch(msg->type) {
+	case AIC_NL_DAEMON_ON_TYPE:
+		nl_daemon_on = 1;
+		AICWFDBG(LOGSTEER, MANAGER_STR"AIC_NL_DAEMON_ON_TYPE\n");
+		for (band = 0; band < PHY_BAND_MAX; band++) {
+			for (ssid = 0; ssid < CONFIG_IFACE_NUMBER; ssid++) {
+				rwnx_vif = nl_rwnx_vif[band][ssid];
+				rwnx_hook = nl_hook[band][ssid];
+
+				if (!rwnx_hook) {
+					AICWFDBG(LOGSTEER, MANAGER_STR"%s, search for the next rwnx_hook, %d,%d\n", __func__, band, ssid);
+					continue;
+				}
+				if (rwnx_vif == NULL || rwnx_vif->up == false) {
+					AICWFDBG(LOGSTEER, MANAGER_STR"%s, !rwnx_vif, %d,%d\n", __func__, band, ssid);
+					continue;
+				}
+
+#ifdef CONFIG_BAND_STEERING
+				aicwf_band_steering_init(rwnx_vif);
+#endif
+
+				spin_lock_bh(&rwnx_vif->rwnx_hw->cb_lock);
+				list_for_each_entry(sta, &rwnx_vif->ap.sta_list, list){
+					if (sta->valid)
+						aicwf_nl_send_new_sta_msg(rwnx_vif, sta->mac_addr);
+				}
+				spin_unlock_bh(&rwnx_vif->rwnx_hw->cb_lock);
+			}
+		}
+		break;
+	case AIC_NL_DAEMON_OFF_TYPE:
+		nl_daemon_on = 0;
+		break;
+#ifdef CONFIG_BAND_STEERING
+	case AIC_NL_B_STEER_BLOCK_ADD_TYPE:
+	case AIC_NL_B_STEER_BLOCK_DEL_TYPE:
+		while (offset < msg->len) {
+			hdr = (struct b_elm_header *)(msg->content + offset);
+			offset += ELM_HEADER_LEN;
+
+			switch(hdr->id) {
+			case AIC_ELM_INTF_ID:
+				intf = (struct b_elm_intf *)(msg->content + offset);
+				break;
+			case AIC_ELM_STA_INFO_ID:
+				sta_info = (struct b_elm_sta_info *)(msg->content + offset);
+				break;
+			default:
+				AICWFDBG(LOGERROR, MANAGER_STR"unknown element id.\n");
+				break;
+			}
+			offset += hdr->len;
+		}
+
+		if (intf && sta_info) {
+			band = intf->band;
+			ssid = intf->ssid;
+			AICWFDBG(LOGSTEER, MANAGER_STR"STEER_BLOCK band: %d, ssid: %d\n", band, ssid);
+			rwnx_vif = nl_rwnx_vif[band][ssid];
+			rwnx_hook = nl_hook[band][ssid];
+
+			if (!rwnx_hook) {
+				//AICWFDBG(LOGSTEER, MANAGER_STR"Not this driver's msg p1.\n");
+				break;
+			}
+			if (rwnx_vif == NULL || rwnx_vif->up == false) {
+				AICWFDBG(LOGSTEER, MANAGER_STR"rwnx_vif is null/down p1.\n");
+				break;
+			}
+
+			if (msg->type == AIC_NL_B_STEER_BLOCK_ADD_TYPE)
+				aicwf_band_steering_block_entry_add(rwnx_vif, sta_info->mac);
+			else if (msg->type == AIC_NL_B_STEER_BLOCK_DEL_TYPE)
+				aicwf_band_steering_block_entry_del(rwnx_vif, sta_info->mac);
+		}
+		break;
+	case AIC_NL_B_STEER_ROAM_TYPE:
+		while (offset < msg->len) {
+			hdr = (struct b_elm_header *)(msg->content + offset);
+			offset += ELM_HEADER_LEN;
+
+			/* element type: should handle wrong length */
+			switch(hdr->id) {
+			case AIC_ELM_INTF_ID:
+				intf = (struct b_elm_intf *)(msg->content + offset);
+				break;
+			case AIC_ELM_ROAM_INFO_ID:
+				roam_info = (struct b_elm_roam_info *)(msg->content + offset);
+				break;
+			default:
+				AICWFDBG(LOGERROR, MANAGER_STR"unknown element id.\n");
+				break;
+			}
+			offset += hdr->len;
+		}
+
+		if (intf && roam_info) {
+			band = intf->band;
+			ssid = intf->ssid;
+			rwnx_vif = nl_rwnx_vif[band][ssid];
+			rwnx_hook = nl_hook[band][ssid];
+
+			if (!rwnx_hook) {
+				//AICWFDBG(LOGERROR, MANAGER_STR"Not this driver's msg p2.\n");
+				break;
+			}
+			if (rwnx_vif == NULL || rwnx_vif->up == false) {
+				AICWFDBG(LOGERROR, MANAGER_STR"rwnx_vif is null/down p2.\n");
+				break;
+			}
+
+			AICWFDBG(LOGSTEER, MANAGER_STR"AIC_NL_B_STEER_ROAM_TYPE (hostapd_cli)!\n");
+			AICWFDBG(LOGSTEER, MANAGER_STR"sta_mac="MAC_FMT"\n", MAC_ARG(roam_info->sta_mac));
+			AICWFDBG(LOGSTEER, MANAGER_STR"bss_mac="MAC_FMT" bss_ch=%u method=%s\n", 
+				MAC_ARG(roam_info->bss_mac),
+				roam_info->bss_ch,
+				roam_info->method == 0 ? "11V" : "Deauth");
+
+			if (roam_info->method == 1)
+				aicwf_band_steering_roam_block_entry_add(rwnx_vif, roam_info->sta_mac);
+		}
+		break;
+#endif
+	default:
+		AICWFDBG(LOGERROR, MANAGER_STR"unknown message type.\n");
+		break;
+	}
+
+	return;
+}
+
+void aicwf_nl_send_msg(void *msg, u32 msg_len)
+{
+	struct nlmsghdr *nlh = NULL;
+	struct sk_buff *skb = NULL;
+	u32 skb_len;
+	s32 err;
+
+	skb_len = NLMSG_SPACE(NL_MAX_MSG_SIZE);
+	skb = __dev_alloc_skb(skb_len, GFP_ATOMIC);
+	if (!skb) {
+		AICWFDBG(LOGERROR, MANAGER_STR"allocate skb failed.\n");
+		goto func_return;
+	}
+
+	nlh = nlmsg_put(skb, 0, 0, 0, NL_MAX_MSG_SIZE, 0);
+	if (!nlh) {
+		AICWFDBG(LOGERROR, MANAGER_STR"put netlink header failed.\n");
+		kfree_skb(skb);
+		goto func_return;
+	}
+
+	NETLINK_CB(skb).portid = 0;
+	NETLINK_CB(skb).dst_group = 0;
+	memset(NLMSG_DATA(nlh), 0, msg_len);
+	memcpy(NLMSG_DATA(nlh), (u8_l *)msg, msg_len);
+
+	if (!nl_sock) {
+		AICWFDBG(LOGERROR, MANAGER_STR"[%s %u] nl_sock is NULL\n", __FUNCTION__, __LINE__);
+		goto msg_fail_skb;
+	}
+
+	err = netlink_unicast(nl_sock, skb, NL_AIC_MANAGER_PID, MSG_DONTWAIT);
+
+	if (err < 0) {
+		/* netlink_unicast() already kfree_skb */
+		AICWFDBG(LOGSTEER, MANAGER_STR"send netlink unicast failed.\n");
+		goto func_return;
+	}
+
+func_return:
+	return;
+
+msg_fail_skb:
+	kfree_skb(skb);
+}
+
+static void aicwf_netlink_set_msg(
+	struct b_nl_message *msg, u32 *msg_len, void *elm, u32 elm_len)
+{
+	memcpy(msg->content + (*msg_len), elm, elm_len);
+	(*msg_len) += elm_len;
+
+	return;
+}
+
+void aicwf_nl_send_del_sta_msg(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	u32 msg_len = 0;
+	struct b_nl_message msg = {0};
+	struct b_elm_header hdr = {0};
+	struct b_elm_intf intf = {{0}};
+	struct b_elm_sta_info sta_info = {{0}};
+
+	if (!nl_daemon_on)
+		return;
+
+	AICWFDBG(LOGSTEER, MANAGER_STR"%s, "MAC_FMT"\n", __func__, MAC_ARG(mac));
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_ID;
+	hdr.len = ELM_INTF_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+	
+	/* element: AIC_ELM_INTF_ID */
+	intf.root = 0; /* TBD */
+	intf.band = rwnx_vif->ap.band;
+	intf.ssid = rwnx_vif->rwnx_hw->iface_idx;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf, ELM_INTF_LEN);
+
+	/* element header */
+	hdr.id = AIC_ELM_STA_INFO_ID;
+	hdr.len = ELM_STA_INFO_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_STA_INFO_ID */
+	memcpy(sta_info.mac, mac, 6);
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&sta_info, ELM_STA_INFO_LEN);
+
+	/* finish message */
+	msg.type = AIC_NL_DEL_STA_TYPE;
+	msg.len = msg_len;
+
+	/* length += (type + len) */
+	msg_len += 8;
+	aicwf_nl_send_msg((void *)&msg, msg_len);
+
+	return;
+}
+
+void aicwf_nl_send_new_sta_msg(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	u32 msg_len = 0;
+	struct b_nl_message msg = {0};
+	struct b_elm_header hdr = {0};
+	struct b_elm_intf intf = {{0}};
+	struct b_elm_sta_info sta_info = {{0}};
+
+	if (!nl_daemon_on)
+		return;
+
+	AICWFDBG(LOGSTEER, MANAGER_STR"%s, "MAC_FMT"\n", __func__, MAC_ARG(mac));
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_ID;
+	hdr.len = ELM_INTF_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+	
+	/* element: AIC_ELM_INTF_ID */
+	intf.root = 0; /* TBD */
+	intf.band = rwnx_vif->ap.band;
+	intf.ssid = rwnx_vif->rwnx_hw->iface_idx;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf, ELM_INTF_LEN);
+
+	/* element header */
+	hdr.id = AIC_ELM_STA_INFO_ID;
+	hdr.len = ELM_STA_INFO_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_STA_INFO_ID */
+	memcpy(sta_info.mac, mac, 6);
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&sta_info, ELM_STA_INFO_LEN);
+
+	/* finish message */
+	msg.type = AIC_NL_NEW_STA_TYPE;
+	msg.len = msg_len;
+
+	/* length += (type + len) */
+	msg_len += 8;
+	aicwf_nl_send_msg((void *)&msg, msg_len);
+
+	return;
+}
+
+void aicwf_nl_send_intf_rpt_msg(struct rwnx_vif *rwnx_vif)
+{
+	u32 msg_len = 0;
+	struct b_nl_message msg = {0};
+	struct b_elm_header hdr = {0};
+	struct b_elm_intf intf = {{0}};
+	struct b_elm_intf_info intf_info = {0};
+
+	if (!nl_daemon_on)
+		return;
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_ID;
+	hdr.len = ELM_INTF_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_INTF_ID */
+	memcpy(intf.mac, rwnx_vif->ndev->dev_addr, 6);
+	intf.root = 0; /* TBD */
+	intf.band = rwnx_vif->ap.band;
+	intf.ssid = rwnx_vif->rwnx_hw->iface_idx;
+	memcpy(intf.name, rwnx_vif->ndev->name, 16);
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf, ELM_INTF_LEN);
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_INFO_ID;
+	hdr.len = ELM_INTF_INFO_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_INTF_INFO_ID */
+	intf_info.ch = freq_to_channel(rwnx_vif->ap.freq);
+	intf_info.tx_tp = 0; /* TBD */
+	intf_info.rx_tp = 0; /* TBD */
+
+	intf_info.bss_info = 0;
+	intf_info.reg_class = (rwnx_vif->ap.band == 0) ? 81 : 128;
+	intf_info.phy_type = 7;
+
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf_info, ELM_INTF_INFO_LEN);
+
+	/* finish message */
+	msg.type = AIC_NL_INTF_RPT_TYPE;
+	msg.len = msg_len;
+
+	/* length += (type + len) */
+	msg_len += 8;
+	aicwf_nl_send_msg((void *)&msg, msg_len);
+
+	return;
+}
+
+void aicwf_nl_send_sta_rpt_msg(struct rwnx_vif *rwnx_vif, struct rwnx_sta *sta)
+{
+	u32 msg_len = 0;
+	struct b_nl_message msg = {0};
+	struct b_elm_header hdr = {0};
+	struct b_elm_intf intf = {{0}};
+	struct b_elm_sta_info sta_info = {{0}};
+	struct b_elm_sta_info_ext sta_info_ext = {{0}};
+
+	if (!nl_daemon_on)
+		return;
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_ID;
+	hdr.len = ELM_INTF_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_INTF_ID */
+	memcpy(intf.mac, rwnx_vif->ndev->dev_addr, 6);
+	intf.root = 0; /* TBD */
+	intf.band = rwnx_vif->ap.band;
+	intf.ssid = rwnx_vif->rwnx_hw->iface_idx;
+	memcpy(intf.name, rwnx_vif->ndev->name, 16);
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf, ELM_INTF_LEN);
+
+	/* element header */
+	hdr.id = AIC_ELM_STA_INFO_ID;
+	hdr.len = ELM_STA_INFO_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_STA_INFO_ID */
+	memcpy(sta_info.mac, sta->mac_addr, 6);
+	sta_info.rssi = sta->rssi;
+	sta_info.link_time = sta->link_time;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&sta_info, ELM_STA_INFO_LEN);
+
+	/* element header */
+	hdr.id = AIC_ELM_STA_INFO_EXT_ID;
+	hdr.len = ELM_STA_INFO_EXT_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_STA_INFO_EXT_ID */
+	memcpy(sta_info_ext.mac, sta->mac_addr, 6);
+	sta_info_ext.supported_band = sta->support_band;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&sta_info_ext, ELM_STA_INFO_EXT_LEN);
+
+	/* finish message */
+	msg.type = AIC_NL_STA_RPT_TYPE;
+	msg.len = msg_len;
+
+	/* length += (type + len) */
+	msg_len += 8;
+	aicwf_nl_send_msg((void *)&msg, msg_len);
+
+	return;
+}
+
+void aicwf_nl_send_frame_rpt_msg(struct rwnx_vif *rwnx_vif, u16_l frame_type, u8_l *sa, s8_l rssi)
+{
+	u32 msg_len = 0;
+	struct b_nl_message msg = {0};
+	struct b_elm_header hdr = {0};
+	struct b_elm_frame_info frame_info = {0};
+	struct b_elm_intf intf = {{0}};
+
+	if (!nl_daemon_on)
+		return;
+
+	//AICWFDBG(LOGSTEER, "[NETLINK] %s, sta: "MAC_FMT"\n", __func__, MAC_ARG(sa));
+
+	/* TBD */
+	if (frame_type == WIFI_PROBEREQ && rssi <= LOW_RSSI_IGNORE) {
+		AICWFDBG(LOGSTEER, MANAGER_STR"WIFI_PROBEREQ <= %d, ignore\n", LOW_RSSI_IGNORE);
+		return;
+	}
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_ID;
+	hdr.len = ELM_INTF_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_INTF_ID */
+	intf.root = 0; /* TBD */
+	intf.band = rwnx_vif->ap.band;
+	intf.ssid = rwnx_vif->rwnx_hw->iface_idx;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf, ELM_INTF_LEN);
+
+	/* element header */
+	hdr.id = AIC_ELM_FRAME_INFO_ID;
+	hdr.len = ELM_FRAME_INFO_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+	
+	/* element: AIC_ELM_FRAME_INFO_ID */
+	frame_info.frame_type = frame_type;
+	memcpy(frame_info.sa, sa, 6);
+	frame_info.rssi = rssi;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&frame_info, ELM_FRAME_INFO_LEN);
+
+	/* finish message */
+	msg.type = AIC_NL_FRAME_RPT_TYPE;
+	msg.len = msg_len;
+
+	/* length += (type + len) */
+	msg_len += 8;
+	aicwf_nl_send_msg((void *)&msg, msg_len);
+
+	return;
+}
+
+void aicwf_nl_send_time_tick_msg(struct rwnx_vif *rwnx_vif)
+{
+	u32 msg_len = 0;
+	struct b_nl_message msg = {0};
+	struct b_elm_header hdr = {0};
+	struct b_elm_intf intf = {{0}};
+
+	if (!nl_daemon_on)
+		return;
+
+	/* element header */
+	hdr.id = AIC_ELM_INTF_ID;
+	hdr.len = ELM_INTF_LEN;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&hdr, ELM_HEADER_LEN);
+
+	/* element: AIC_ELM_INTF_ID */
+	intf.root = 0; /* TBD */
+	intf.band = rwnx_vif->ap.band;
+	intf.ssid = rwnx_vif->rwnx_hw->iface_idx;
+	aicwf_netlink_set_msg(&msg, &msg_len, (void *)&intf, ELM_INTF_LEN);
+
+	/* finish message */
+	msg.type = AIC_NL_TIME_TICK_TYPE;
+	msg.len = msg_len;
+
+	/* length += (type + len) */
+	msg_len += 8;
+	aicwf_nl_send_msg((void *)&msg, msg_len);
+
+	return;
+}
+
+void aicwf_nl_hook(struct rwnx_vif *rwnx_vif, u8_l band, u8_l ssid)
+{
+	AICWFDBG(LOGSTEER, MANAGER_STR"%s band:%d, ssid:%d\n", __func__, band, ssid);
+
+	nl_hook[band][ssid] = 1;
+	nl_rwnx_vif[band][ssid] = rwnx_vif;
+
+	return;
+}
+
+void aicwf_nl_hook_deinit(u8_l band, u8_l ssid)
+{
+
+	AICWFDBG(LOGSTEER, MANAGER_STR"%s band:%d, ssid:%d\n", __func__, band, ssid);
+
+	nl_hook[band][ssid] = 0;
+	nl_rwnx_vif[band][ssid] = NULL;
+
+	return;
+}
+
+
+void aicwf_nl_init(void)
+{
+	if (nl_sock) {
+		AICWFDBG(LOGSTEER, MANAGER_STR"netlink already init.\n");
+		return;
+	}
+	struct netlink_kernel_cfg cfg = {
+		.input = aicwf_nl_recv_msg,
+	};
+
+	nl_sock = netlink_kernel_create(&init_net, NL_AIC_PROTOCOL, &cfg);
+	if (!nl_sock)
+		AICWFDBG(LOGERROR, MANAGER_STR"create netlink falied.\n");
+
+	return;
+}
+
+void aicwf_nl_deinit(void)
+{
+	if(nl_sock)
+	{
+		netlink_kernel_release(nl_sock);
+		nl_sock = NULL;
+	}
+	AICWFDBG(LOGSTEER, MANAGER_STR"[aicwf_nl_deinit] delete nl_sock netlink succeed.\n");
+
+	return;
+}
+

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_manager.h

@@ -0,0 +1,146 @@
+#ifndef _AICWF_MANAGER_H_
+#define _AICWF_MANAGER_H_
+
+#include "lmac_types.h"
+#include "rwnx_defs.h"
+
+#define DRV_WLAN_MANAGER_VER       "v1.0"
+
+
+/* TBD */
+#define CONFIG_IFACE_NUMBER        1
+
+#define NL_AIC_PROTOCOL_FRT_DRV    28
+#define NL_AIC_PROTOCOL_SEC_DRV    29
+#define NL_AIC_PROTOCOL            NL_AIC_PROTOCOL_SEC_DRV
+
+#define NL_AIC_MANAGER_PID        5185
+
+#define NL_MAX_MSG_SIZE            768
+
+/* Netlink Message Type List */
+#define AIC_NL_DAEMON_ON_TYPE            1
+#define AIC_NL_DAEMON_OFF_TYPE           2
+#define AIC_NL_DAEMON_ALIVE_TYPE         3
+#define AIC_NL_DEL_STA_TYPE              4
+#define AIC_NL_NEW_STA_TYPE              5
+#define AIC_NL_INTF_RPT_TYPE             6
+#define AIC_NL_STA_RPT_TYPE              7
+#define AIC_NL_FRAME_RPT_TYPE            8
+#define AIC_NL_TIME_TICK_TYPE            9
+#define AIC_NL_PRIV_INFO_CMD_TYPE        10
+#ifdef CONFIG_BAND_STEERING
+#define AIC_NL_B_STEER_CMD_TYPE          11
+#define AIC_NL_B_STEER_BLOCK_ADD_TYPE    12
+#define AIC_NL_B_STEER_BLOCK_DEL_TYPE    13
+#define AIC_NL_B_STEER_ROAM_TYPE         14
+#endif
+
+#define AIC_NL_GENERAL_CMD_TYPE          100
+#define AIC_NL_CUSTOMER_TYPE             101
+#define AIC_NL_CONFIG_UPDATE_TYPE        102
+
+/* Element ID */
+#define AIC_ELM_INTF_ID            1
+#define AIC_ELM_INTF_INFO_ID       2
+#define AIC_ELM_FRAME_INFO_ID      3
+#define AIC_ELM_STA_INFO_ID        4
+#define AIC_ELM_ROAM_INFO_ID       5
+#define AIC_ELM_BUFFER_ID          6
+#define AIC_ELM_STA_INFO_EXT_ID    7
+
+#define LOW_RSSI_IGNORE              (-85)
+
+struct b_nl_message {
+	u32_l type;
+	u32_l len;
+	u8_l  content[NL_MAX_MSG_SIZE];
+};
+
+struct b_elm_header {
+	u8_l id;
+	u8_l len;
+};
+
+struct b_elm_intf {
+	u8_l  mac[6];
+	u8_l  root;
+	u8_l  band;
+	u8_l  ssid;
+	s8_l  name[16];
+};
+
+struct b_elm_intf_info {
+	u16_l ch;
+	u8_l  ch_clm;
+	u8_l  ch_noise;
+	u32_l tx_tp;
+	u32_l rx_tp;
+	u32_l assoc_sta_num;
+	/* self neighbor report info */
+	u32_l bss_info;
+	u8_l  reg_class;
+	u8_l  phy_type;
+};
+
+struct b_elm_frame_info {
+	u16_l frame_type;
+	u8_l  sa[6];
+	s8_l  rssi;
+};
+
+struct b_elm_sta_info {
+	u8_l  mac[6];
+	s8_l rssi;
+	u32_l link_time;
+	u32_l tx_tp; /* kbits */
+	u32_l rx_tp; /* kbits */
+};
+
+struct b_elm_roam_info {
+	u8_l  sta_mac[6]; /* station mac */
+	u8_l  bss_mac[6]; /* target bss mac */
+	u16_l bss_ch; /* target bss channel */
+	u8_l  method; /* 0: 11V, 1: Deauth */
+};
+
+struct b_elm_buffer {
+	u8_l buf[255];
+};
+
+struct b_elm_sta_info_ext {
+	u8_l mac[6];
+	u8_l supported_band; /* bit0:2g bit1:5g */
+	u8_l empty[119]; /* for future use */
+};
+
+
+/* Element Size List */
+#define ELM_HEADER_LEN            (sizeof(struct b_elm_header))
+#define ELM_INTF_LEN              (sizeof(struct b_elm_intf))
+#define ELM_INTF_INFO_LEN         (sizeof(struct b_elm_intf_info))
+#define ELM_FRAME_INFO_LEN        (sizeof(struct b_elm_frame_info))
+#define ELM_STA_INFO_LEN          (sizeof(struct b_elm_sta_info))
+#define ELM_ROAM_INFO_LEN         (sizeof(struct b_elm_roam_info))
+#define ELM_BUFFER_LEN            (sizeof(struct b_elm_buffer))
+#define ELM_STA_INFO_EXT_LEN      (sizeof(struct b_elm_sta_info_ext))
+
+
+
+void aicwf_nl_send_del_sta_msg(struct rwnx_vif *rwnx_vif, u8_l *mac);
+void aicwf_nl_send_new_sta_msg(struct rwnx_vif *rwnx_vif, u8_l *mac);
+void aicwf_nl_send_intf_rpt_msg(struct rwnx_vif *rwnx_vif);
+void aicwf_nl_send_sta_rpt_msg(struct rwnx_vif *rwnx_vif, struct rwnx_sta *sta);
+void aicwf_nl_send_frame_rpt_msg(struct rwnx_vif *rwnx_vif, u16_l frame_type, u8_l *sa, s8_l rssi);
+void aicwf_nl_send_time_tick_msg(struct rwnx_vif *rwnx_vif);
+void aicwf_nl_hook(struct rwnx_vif *rwnx_vif, u8_l band, u8_l iface_id);
+void aicwf_nl_hook_deinit(u8_l band, u8_l ssid);
+void aicwf_nl_init(void);
+void aicwf_nl_deinit(void);
+void aicwf_wlan_manager_recv_msg(struct b_nl_message *msg);
+void aicwf_nl_recv_msg(struct sk_buff *skb);
+void aicwf_nl_send_msg(void *msg, u32_l msg_len);
+
+
+#endif
+

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_sdio.h

@@ -57,6 +57,20 @@
 #define SDIO_ACTIVE_ST                   1
 
 #define DATA_FLOW_CTRL_THRESH 2
+#ifdef CONFIG_TX_NETIF_FLOWCTRL
+#define AICWF_SDIO_TX_LOW_WATER          100
+#define AICWF_SDIO_TX_HIGH_WATER         500
+#endif
+
+#ifdef CONFIG_TEMP_CONTROL
+#define TEMP_GET_INTERVAL                (60 * 1000)
+#define TEMP_THD_1                       80  //temperature 1 (℃)
+#define TEMP_THD_2                       95 //temperature 2 (℃)
+#define BUFFERING_V1                     8
+#define BUFFERING_V2                     13
+#define TMR_INTERVAL_1                   60  //timer_1 60ms
+#define TMR_INTERVAL_2                   180 //timer_2 130ms
+#endif
 
 typedef enum {
 	SDIO_TYPE_DATA         = 0X00,
@@ -70,16 +84,19 @@ typedef enum {
 #define SDIO_VENDOR_ID_AIC8801                0x5449
 #define SDIO_VENDOR_ID_AIC8800DC              0xc8a1
 #define SDIO_VENDOR_ID_AIC8800D80             0xc8a1
+#define SDIO_VENDOR_ID_AIC8800D80X2           0xc8a1
 
 #define SDIO_DEVICE_ID_AIC8801				0x0145
 #define SDIO_DEVICE_ID_AIC8800DC			0xc08d
 #define SDIO_DEVICE_ID_AIC8800D80           0x0082
+#define SDIO_DEVICE_ID_AIC8800D80X2         0x2082
 
 enum AICWF_IC{
 	PRODUCT_ID_AIC8801	=	0,
 	PRODUCT_ID_AIC8800DC,
 	PRODUCT_ID_AIC8800DW,
-	PRODUCT_ID_AIC8800D80
+	PRODUCT_ID_AIC8800D80,
+	PRODUCT_ID_AIC8800D80X2
 };
 
 
@@ -103,6 +120,7 @@ struct aic_sdio_reg {
 struct aic_sdio_dev {
 	struct rwnx_hw *rwnx_hw;
 	struct sdio_func *func;
+	struct sdio_func *func2;
 	struct device *dev;
 	struct aicwf_bus *bus_if;
 	struct rwnx_cmd_mgr cmd_mgr;
@@ -110,6 +128,10 @@ struct aic_sdio_dev {
 	struct aicwf_rx_priv *rx_priv;
 	struct aicwf_tx_priv *tx_priv;
 	u32 state;
+#ifdef CONFIG_TX_NETIF_FLOWCTRL
+	u8 flowctrl;
+	spinlock_t tx_flow_lock;
+#endif
 
     #if defined(CONFIG_SDIO_PWRCTRL)
 	//for sdio pwr ctrl
@@ -126,9 +148,35 @@ struct aic_sdio_dev {
 	spinlock_t wslock;//AIDEN test
 	bool oob_enable;
     atomic_t is_bus_suspend;
+
+#ifdef CONFIG_TEMP_CONTROL
+	spinlock_t tx_flow_lock;
+	struct timer_list netif_timer;
+	struct timer_list tp_ctrl_timer;
+	struct work_struct tp_ctrl_work;
+	struct work_struct netif_work;
+	s8_l cur_temp;
+	bool net_stop;
+	bool on_off;	  //for command, 0 - off, 1 - on
+	int8_t get_level; //for command, 0 - 100%, 1 - 12%, 2 - 3%
+	int8_t set_level; //for command, 0 - driver auto, 1 - 12%, 2 - 3%
+	int interval_t1;
+	int interval_t2;
+	u8_l cur_stat;	  //0--normal temp, 1/2--buffering temp
+#endif
+
 };
+
+#ifdef CONFIG_TEMP_CONTROL
+void aicwf_netif_worker(struct work_struct *work);
+void aicwf_temp_ctrl_worker(struct work_struct *work);
+void aicwf_temp_ctrl(struct aic_sdio_dev *sdiodev);
+void aicwf_netif_ctrl(struct aic_sdio_dev *sdiodev, int val);
+#endif
 extern struct aicwf_rx_buff_list aic_rx_buff_list;
 int aicwf_sdio_writeb(struct aic_sdio_dev *sdiodev, uint regaddr, u8 val);
+int aicwf_sdio_func2_readb(struct aic_sdio_dev *sdiodev, uint regaddr, u8 *val);
+int aicwf_sdio_func2_writeb(struct aic_sdio_dev *sdiodev, uint regaddr, u8 val);
 void aicwf_sdio_hal_irqhandler(struct sdio_func *func);
 
 #if defined(CONFIG_SDIO_PWRCTRL)
@@ -139,6 +187,9 @@ void aicwf_sdio_reg_init(struct aic_sdio_dev *sdiodev);
 int aicwf_sdio_func_init(struct aic_sdio_dev *sdiodev);
 int aicwf_sdiov3_func_init(struct aic_sdio_dev *sdiodev);
 void aicwf_sdio_func_deinit(struct aic_sdio_dev *sdiodev);
+#ifdef CONFIG_TX_NETIF_FLOWCTRL
+void aicwf_sdio_tx_netif_flowctrl(struct rwnx_hw *rwnx_hw, bool state);
+#endif
 int aicwf_sdio_flow_ctrl(struct aic_sdio_dev *sdiodev);
 int aicwf_sdio_flow_ctrl_msg(struct aic_sdio_dev *sdiodev);
 #ifdef CONFIG_PREALLOC_RX_SKB

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_steering.c

@@ -0,0 +1,217 @@
+/**
+ ******************************************************************************
+ *
+ * Copyright (C) 2020 AIC semiconductor.
+ *
+ * @file aicwf_steering.c
+ *
+ * @brief band steering definitions
+ *
+ ******************************************************************************
+ */
+
+#include "aicwf_steering.h"
+#include "rwnx_defs.h"
+
+#define MAC_FMT_B "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG_B(x) ((u8_l *)(x))[0], ((u8_l *)(x))[1], ((u8_l *)(x))[2], ((u8_l *)(x))[3], ((u8_l *)(x))[4], ((u8_l *)(x))[5]
+#define STEEER_STR "[STEERING] SDIO "
+
+#ifdef CONFIG_BAND_STEERING
+
+static struct b_steer_block_entry *block_entry_lookup(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	u8_l i;
+	struct b_steer_block_entry *ent = NULL;
+
+	for (i = 0; i < B_STEER_ENTRY_NUM; i++) {
+		ent = &(rwnx_vif->bsteerpriv.block_list[i]);
+		if (ent->used && (memcmp(ent->mac, mac, 6) == 0)) {
+			AICWFDBG(LOGSTEER, STEEER_STR"%s "MAC_FMT_B"\n", __func__, MAC_ARG_B(mac));
+			return ent;
+		}
+	}
+
+	return NULL;
+}
+
+void aicwf_band_steering_expire(struct rwnx_vif *rwnx_vif)
+{
+	u8_l i;
+	struct b_steer_block_entry *ent = NULL;
+
+	if (rwnx_vif->bsteerpriv.inited == false) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s bsteerpriv not inited\n", __func__);
+		return;
+	}
+
+	spin_lock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	/* block entry */
+	for (i = 0; i < B_STEER_ENTRY_NUM; i++) {
+		ent = &(rwnx_vif->bsteerpriv.block_list[i]);
+		if (!ent->used)
+			continue;
+
+		if (ent->entry_expire) {
+			ent->entry_expire--;
+			if (ent->entry_expire == 0)
+				ent->used = 0;
+		}
+	}
+
+	spin_unlock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	return;
+}
+
+s32_l aicwf_band_steering_block_chk(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	s32 ret = 0;
+	struct b_steer_block_entry *ent = NULL;
+
+	if (rwnx_vif->bsteerpriv.inited == false) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s bsteerpriv not inited\n", __func__);
+		return 0;
+	}
+
+	spin_lock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	ent = block_entry_lookup(rwnx_vif, mac);
+	if (ent)
+		ret = 1;
+
+	spin_unlock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	return ret;
+}
+
+void aicwf_band_steering_block_entry_add(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	u8_l i;
+	struct b_steer_block_entry *ent = NULL;
+
+	if (rwnx_vif->bsteerpriv.inited == false) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s bsteerpriv not inited\n", __func__);
+		return;
+	}
+
+	AICWFDBG(LOGSTEER, STEEER_STR"%s "MAC_FMT_B"\n", __func__, MAC_ARG_B(mac));
+
+	spin_lock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	ent = block_entry_lookup(rwnx_vif, mac);
+
+	/* already exist */
+	if (ent) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s already exist\n", __func__);
+		ent->entry_expire = B_STEER_BLOCK_ENTRY_EXPIRE;
+		goto func_return;
+	}
+
+	/* find an empty entry */
+	for (i = 0; i < B_STEER_ENTRY_NUM; i++) {
+		if (!rwnx_vif->bsteerpriv.block_list[i].used) {
+			ent = &(rwnx_vif->bsteerpriv.block_list[i]);
+			break;
+		}
+	}
+
+	/* add the entry */
+	if (ent) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s "MAC_FMT_B"\n", __func__, MAC_ARG_B(mac));
+		ent->used = 1;
+		memcpy(ent->mac, mac, 6);
+		ent->entry_expire = B_STEER_BLOCK_ENTRY_EXPIRE;
+	}
+
+func_return:
+	spin_unlock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	return;
+}
+
+void aicwf_band_steering_block_entry_del(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	struct b_steer_block_entry *ent = NULL;
+
+	if (rwnx_vif->bsteerpriv.inited == false) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s bsteerpriv not inited\n", __func__);
+		return;
+	}
+
+	AICWFDBG(LOGSTEER, STEEER_STR"%s "MAC_FMT_B"\n", __func__, MAC_ARG_B(mac));
+
+	spin_lock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	ent = block_entry_lookup(rwnx_vif, mac);
+	if (ent)
+		ent->used = 0;
+
+	spin_unlock_bh(&(rwnx_vif->bsteerpriv.lock));
+
+	return;
+}
+
+void aicwf_band_steering_roam_block_entry_add(struct rwnx_vif *rwnx_vif, u8_l *mac)
+{
+	u8_l i;
+	struct b_steer_block_entry *ent = NULL;
+
+	if (rwnx_vif->bsteerpriv.inited == false) {
+		AICWFDBG(LOGSTEER, STEEER_STR"%s bsteerpriv not inited\n", __func__);
+		return;
+	}
+
+	AICWFDBG(LOGSTEER, STEEER_STR"%s "MAC_FMT_B"\n", __func__, MAC_ARG_B(mac));
+
+	spin_lock_bh(&rwnx_vif->bsteerpriv.lock);
+
+	ent = block_entry_lookup(rwnx_vif, mac);
+
+	/* already exist */
+	if (ent)
+		goto func_return;
+
+	/* find an empty entry */
+	for (i = 0; i < B_STEER_ENTRY_NUM; i++) {
+		if (!rwnx_vif->bsteerpriv.block_list[i].used) {
+			ent = &(rwnx_vif->bsteerpriv.block_list[i]);
+			break;
+		}
+	}
+
+	/* add the entry */
+	if (ent) {
+		ent->used = 1;
+		memcpy(ent->mac, mac, 6);
+		ent->entry_expire = B_STEER_ROAM_BLOCK_ENTRY_EXPIRE;
+	}
+
+func_return:
+	spin_unlock_bh(&rwnx_vif->bsteerpriv.lock);
+
+	return;
+}
+
+void aicwf_band_steering_init(struct rwnx_vif *rwnx_vif)
+{
+	u8_l i;
+
+	AICWFDBG(LOGSTEER, STEEER_STR"%s\n", __func__);
+	spin_lock_init(&rwnx_vif->bsteerpriv.lock);
+	rwnx_vif->bsteerpriv.inited = true;
+
+	spin_lock_bh(&rwnx_vif->bsteerpriv.lock);
+
+	/* block entry */
+	for (i = 0; i < B_STEER_ENTRY_NUM; i++)
+		memset(&(rwnx_vif->bsteerpriv.block_list[i]), 0, sizeof(struct b_steer_block_entry));
+
+	spin_unlock_bh(&rwnx_vif->bsteerpriv.lock);
+
+	return;
+}
+
+#endif
+

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_steering.h

@@ -0,0 +1,40 @@
+#ifndef _AICWF_STEERING_H_
+#define _AICWF_STEERING_H_
+
+#include <linux/spinlock.h>
+#include "lmac_types.h"
+
+#ifdef CONFIG_BAND_STEERING
+
+#define B_STEER_ENTRY_NUM                   64//32
+
+#define B_STEER_BLOCK_ENTRY_EXPIRE          60
+#define B_STEER_ROAM_BLOCK_ENTRY_EXPIRE     5
+#define STEER_UPFATE_TIME                   2000
+
+struct rwnx_vif;
+
+struct b_steer_block_entry {
+	u8_l used;
+	u8_l mac[6];
+	u32_l entry_expire;
+};
+
+struct b_steer_priv {
+	struct b_steer_block_entry block_list[B_STEER_ENTRY_NUM];
+	spinlock_t lock;
+	bool inited;
+};
+
+
+void aicwf_band_steering_expire(struct rwnx_vif *rwnx_vif);
+s32_l  aicwf_band_steering_block_chk(struct rwnx_vif *rwnx_vif, u8_l *mac);
+void aicwf_band_steering_block_entry_add(struct rwnx_vif *rwnx_vif, u8_l *mac);
+void aicwf_band_steering_block_entry_del(struct rwnx_vif *rwnx_vif, u8_l *mac);
+void aicwf_band_steering_roam_block_entry_add(struct rwnx_vif *rwnx_vif, u8_l *mac);
+void aicwf_band_steering_init(struct rwnx_vif *rwnx_vif);
+
+#endif
+
+#endif
+

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_tcp_ack.c

@@ -7,7 +7,7 @@ struct msg_buf *intf_tcp_alloc_msg(struct msg_buf *msg)
 {
 	//printk("%s \n",__func__);
 	int len=sizeof(struct msg_buf) ;
-	msg = kzalloc(len , GFP_KERNEL);
+	msg = kzalloc(len , /*GFP_KERNEL*/GFP_ATOMIC);
 	if(!msg)
 		printk("%s: alloc failed \n", __func__);
 	memset(msg,0,len);
@@ -188,7 +188,7 @@ int is_drop_tcp_ack(struct tcphdr *tcphdr, int tcp_tot_len,
 				case TCPOPT_WINDOW:
 					if (*ptr < 15)
 						*win_scale = (1 << (*ptr));
-					printk("%d\n",*win_scale);
+					//printk("%d\n",*win_scale);
 					break;
 				default:
 					drop = 2;
@@ -442,7 +442,7 @@ int tcp_ack_handle_new(struct msg_buf *new_msgbuf,
 	struct tcp_ack_msg *ack;
 	int ret = 0;
 	struct msg_buf *drop_msg = NULL;
-	struct msg_buf * send_msg = NULL;
+	//struct msg_buf * send_msg = NULL;
 	//printk("",);
 	write_seqlock_bh(&ack_info->seqlock);
 
@@ -470,8 +470,8 @@ int tcp_ack_handle_new(struct msg_buf *new_msgbuf,
 				  (ack_info->drop_cnt >=
 				   atomic_read(&ack_m->max_drop_cnt)))){
 			ack_info->drop_cnt = 0;
-			send_msg = new_msgbuf;
-			ack_info->in_send_msg = send_msg;
+			//send_msg = new_msgbuf;
+			ack_info->in_send_msg = new_msgbuf;
 			del_timer(&ack_info->timer);
 		}else{
 			ret = 1;
@@ -550,9 +550,6 @@ int filter_send_tcp_ack(struct rwnx_hw *priv,
 	struct tcp_ack_info *ack_info;
 	struct tcp_ack_manage *ack_m = &priv->ack_m;
 
-	if (plen > MAX_TCP_ACK)
-		return 0;
-
 	tcp_ack_update(ack_m);
 	drop = tcp_check_ack(buf, &ack_msg, &win_scale);
 	//printk("drop:%d win_scale:%d",drop,win_scale);

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_tcp_ack.h

@@ -27,26 +27,7 @@ struct msg_buf {
 	//struct list_head list;
 	struct sk_buff *skb;
 	struct rwnx_vif *rwnx_vif;
-
 	/* data just tx cmd use,not include the head */
-	/*void *data;
-	void *tran_data;
-	unsigned long pcie_addr;
-	u8 type;
-	u8 mode;
-	u16 len;
-	unsigned long timeout;*/
-	/* marlin 2 */
-	/*unsigned int fifo_id;
-	struct sprdwl_msg_list *msglist;*/
-	/* marlin 3 */
-	/*unsigned char buffer_type;
-	struct sprdwl_xmit_msg_list *xmit_msg_list;
-	unsigned char msg_type;
-
-	unsigned long last_time;
-	u8 ctxt_id;*/
-
 };
 
 struct tcp_ack_msg {

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_txrxif.c

@@ -218,6 +218,11 @@ struct aicwf_tx_priv *aicwf_tx_init(void *arg)
 	tx_priv->head = tx_priv->aggr_buf->data;
 	tx_priv->tail = tx_priv->aggr_buf->data;
 
+#ifdef CONFIG_SDIO_ADMA
+	tx_priv->aggr_segcnt = 0;
+	tx_priv->len = 0;
+#endif
+
 	return tx_priv;
 }
 
@@ -231,6 +236,9 @@ void aicwf_tx_deinit(struct aicwf_tx_priv *tx_priv)
 #endif
 		kfree(tx_priv);
 	}
+#ifdef CONFIG_SDIO_ADMA
+	aicwf_sdio_aggrbuf_reset(tx_priv);
+#endif
 }
 
 #ifdef AICWF_SDIO_SUPPORT
@@ -598,12 +606,10 @@ void aicwf_rx_deinit(struct aicwf_rx_priv *rx_priv)
 
 	AICWFDBG(LOGINFO, "%s\n", __func__);
 
-	spin_lock_bh(&rx_priv->stas_reord_lock);
 	list_for_each_entry_safe(reord_info, tmp,
 		&rx_priv->stas_reord_list, list) {
 		reord_deinit_sta(rx_priv, reord_info);
 	}
-	spin_unlock_bh(&rx_priv->stas_reord_lock);
 #endif
 
 #ifdef AICWF_SDIO_SUPPORT

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/aicwf_txrxif.h

@@ -103,6 +103,20 @@ struct aicwf_bus {
         struct task_struct *busirq_thread;//new oob feature
 };
 
+#ifdef CONFIG_SDIO_ADMA
+#define SDIO_HEADER_LEN	4
+#define SDIO_DATA_FAKE_LEN	2
+#define SDIO_MGMT_FAKE_LEN	4
+#define ALIGN4_ADJ_LEN(x)   ((4-(x&3))&3)
+
+#define SDIO_TX_SLIST_MAX   136
+
+/*struct tx_scatterlist {
+	const void *buf;
+	unsigned int len;
+};*/
+#endif
+
 struct aicwf_tx_priv {
 #ifdef AICWF_SDIO_SUPPORT
 	struct aic_sdio_dev *sdiodev;
@@ -128,6 +142,14 @@ struct aicwf_tx_priv {
 	atomic_t aggr_count;
 	u8 *head;
 	u8 *tail;
+
+#ifdef CONFIG_SDIO_ADMA
+	struct tx_scatterlist sg_list[SDIO_TX_SLIST_MAX];
+	void *free_buf[SDIO_TX_SLIST_MAX];
+	bool copyd[SDIO_TX_SLIST_MAX];
+	u32 aggr_segcnt;
+	u32 len;
+#endif
 };
 
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/btsdio.c

@@ -0,0 +1,298 @@
+/*
+ *
+ *  Generic Bluetooth SDIO driver
+ *
+ *  Copyright (C) 2007  Cambridge Silicon Radio Ltd.
+ *  Copyright (C) 2007  Marcel Holtmann <marcel@holtmann.org>
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio_func.h>
+
+#include <net/bluetooth/bluetooth.h>
+
+
+#include "aic_btsdio.h"
+#include "rwnx_msg_tx.h"
+
+#include <net/bluetooth/hci_core.h>
+
+#define VERSION "0.1"
+#if CONFIG_BLUEDROID == 0
+struct btsdio_data {
+	struct hci_dev   *hdev;
+
+	struct work_struct work;
+
+	struct sk_buff_head txq;
+};
+struct hci_dev *ghdev = NULL;
+
+void bt_data_dump(char* tag, void* data, unsigned long len){
+	unsigned long i = 0;
+	uint8_t* data_ = (uint8_t* )data;
+
+	printk("%s %s len:(%lu)\r\n", __func__, tag, len);
+
+	for (i = 0; i < len; i += 16){
+	printk("%02X %02X %02X %02X %02X %02X %02X %02X  %02X %02X %02X %02X %02X %02X %02X %02X\r\n",
+			data_[0 + i],
+			data_[1 + i],
+			data_[2 + i],
+			data_[3 + i],
+			data_[4 + i],
+			data_[5 + i],
+			data_[6 + i],
+			data_[7 + i],
+			data_[8 + i],
+			data_[9 + i],
+			data_[10 + i],
+			data_[11 + i],
+			data_[12 + i],
+			data_[13 + i],
+			data_[14 + i],
+			data_[15 + i]);
+	}
+
+}
+
+static int btsdio_tx_packet(struct btsdio_data *data, struct sk_buff *skb)
+{
+	int err;
+
+	AICBT_INFO("%s", data->hdev->name);
+
+	/* Prepend Type-A header */
+	skb_push(skb, 1);
+	skb->data[0] = hci_skb_pkt_type(skb);
+
+	//bt_data_dump("btwrite", skb->data, skb->len);
+	err = rwnx_sdio_bt_send_req(g_rwnx_plat->sdiodev->rwnx_hw, skb->len, skb);
+	if(err<0){
+		printk("%s rwnx_sdio_bt_send_req error %d",__func__,err);
+		return err;
+	}
+
+	data->hdev->stat.byte_tx += skb->len;
+
+	kfree_skb(skb);
+
+	return 0;
+}
+
+static void btsdio_work(struct work_struct *work)
+{
+	struct btsdio_data *data = container_of(work, struct btsdio_data, work);
+	struct sk_buff *skb;
+	int err;
+
+	AICBT_INFO("%s,%s", data->hdev->name,__func__);
+
+
+	while ((skb = skb_dequeue(&data->txq))) {
+		err = btsdio_tx_packet(data, skb);
+		if (err < 0) {
+			data->hdev->stat.err_tx++;
+			skb_queue_head(&data->txq, skb);
+			break;
+		}
+	}
+}
+
+/* Get HCI device by index.
+ * Device is held on return. */
+struct hci_dev *hci_dev_get(int index)
+{
+    if (index != 0)
+        return NULL;
+
+    return ghdev;
+}
+
+int bt_sdio_recv(u8 *data,u32 data_len)
+{
+	struct sk_buff *skb;
+	int type= data[0];
+	struct hci_dev *hdev;
+	u32 len = data_len;
+	int ret=0;
+	hdev = hci_dev_get(0);
+    if (!hdev) {
+        AICWFDBG(LOGERROR,"%s: Failed to get hci dev[NULL]", __func__);
+        return -ENODEV;
+    }
+
+	skb = alloc_skb(len-1,GFP_ATOMIC);
+	if(!skb){
+		AICWFDBG(LOGERROR, "alloc skb fail %s \n",__func__);
+	}
+	memcpy(skb_put(skb,len-1) ,(data+1), len-1);
+	hdev->stat.byte_rx += len;
+	hci_skb_pkt_type(skb) = type;
+	//if(bt_bypass_event(skb)){
+		//kfree_skb(skb);
+		///return 0;
+	//}
+	AICBT_INFO("skb type %d",type);
+	//bt_data_dump("bt_skb", skb, skb->len);
+	ret = hci_recv_frame(hdev, skb);
+	if(ret < 0){
+		AICWFDBG(LOGERROR, "hci_recv_frame fail %d\n",ret);
+		hdev->stat.err_rx++;
+		kfree_skb(skb);
+	}
+	return 0;
+}
+
+static int btsdio_open(struct hci_dev *hdev)
+{
+	//struct btsdio_data *data = hci_get_drvdata(hdev);
+	int err = 0;
+
+	AICBT_INFO("%s", hdev->name);
+
+	return err;
+}
+
+static int btsdio_close(struct hci_dev *hdev)
+{
+	//struct btsdio_data *data = hci_get_drvdata(hdev);
+
+	AICBT_INFO("%s,%s", hdev->name,__func__);
+
+	return 0;
+}
+
+static int btsdio_flush(struct hci_dev *hdev)
+{
+	struct btsdio_data *data = hci_get_drvdata(hdev);
+
+	AICBT_INFO("%s,%s", hdev->name,__func__);
+
+	skb_queue_purge(&data->txq);
+
+	return 0;
+}
+
+static int btsdio_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
+{
+	struct btsdio_data *data = hci_get_drvdata(hdev);
+
+	AICBT_INFO("%s,%s", hdev->name,__func__);
+
+	switch (hci_skb_pkt_type(skb)) {
+	case HCI_COMMAND_PKT:
+		hdev->stat.cmd_tx++;
+		break;
+
+	case HCI_ACLDATA_PKT:
+		hdev->stat.acl_tx++;
+		break;
+
+	case HCI_SCODATA_PKT:
+		hdev->stat.sco_tx++;
+		break;
+
+	default:
+		return -EILSEQ;
+	}
+
+	skb_queue_tail(&data->txq, skb);
+
+	schedule_work(&data->work);
+
+	return 0;
+}
+
+int btsdio_init(void)
+{
+	struct btsdio_data *data;
+	struct hci_dev *hdev;
+	int err;
+
+	AICBT_INFO("%s", __func__);
+
+
+	data = kzalloc(sizeof(struct btsdio_data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	INIT_WORK(&data->work, btsdio_work);
+
+	skb_queue_head_init(&data->txq);
+
+	hdev = hci_alloc_dev();
+	if (!hdev)
+		return -ENOMEM;
+
+	hdev->bus = HCI_SDIO;
+	hci_set_drvdata(hdev, data);
+
+	hdev->dev_type = HCI_PRIMARY;
+
+	data->hdev = hdev;
+
+	hdev->open     = btsdio_open;
+	hdev->close    = btsdio_close;
+	hdev->flush    = btsdio_flush;
+	hdev->send     = btsdio_send_frame;
+
+	err = hci_register_dev(hdev);
+	if (err < 0) {
+		hci_free_dev(hdev);
+		return err;
+	}
+	ghdev = hdev;
+
+	return 0;
+}
+
+void btsdio_remove(void)
+{
+	struct btsdio_data *data;
+	struct hci_dev *hdev;
+    hdev = hci_dev_get(0);
+    if (!hdev) {
+        AICBT_ERR("%s: Failed to get hci dev[Null]", __func__);
+        return;
+    }
+	data = hci_get_drvdata(hdev);
+
+	AICBT_INFO("btsdio_remove");
+
+	if (!data)
+		return;
+
+	kfree(data);
+
+	hci_unregister_dev(hdev);
+
+	hci_free_dev(hdev);
+}
+#endif

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/hal_desc.h

@@ -33,6 +33,19 @@ extern const int chnl2bw[];
 /* conversion table from MACHW to NL80211 enum */
 extern const int bw2chnl[];
 
+/* Rate cntrl info */
+#define MCS_INDEX_TX_RCX_OFT    0
+#define MCS_INDEX_TX_RCX_MASK   (0x7F << MCS_INDEX_TX_RCX_OFT)
+#define BW_TX_RCX_OFT           7
+#define BW_TX_RCX_MASK          (0x3 << BW_TX_RCX_OFT)
+#define SHORT_GI_TX_RCX_OFT     9
+#define SHORT_GI_TX_RCX_MASK    (0x1 << SHORT_GI_TX_RCX_OFT)
+#define PRE_TYPE_TX_RCX_OFT     10
+#define PRE_TYPE_TX_RCX_MASK    (0x1 << PRE_TYPE_TX_RCX_OFT)
+#define FORMAT_MOD_TX_RCX_OFT   11
+#define FORMAT_MOD_TX_RCX_MASK  (0x7 << FORMAT_MOD_TX_RCX_OFT)
+
+
 /* Values for formatModTx */
 #define FORMATMOD_NON_HT          0
 #define FORMATMOD_NON_HT_DUP_OFDM 1
@@ -95,6 +108,23 @@ union rwnx_mcs_index {
 	u32 legacy : 7;
 };
 
+enum {
+    HW_RATE_1MBPS   = 0,
+    HW_RATE_2MBPS   = 1,
+    HW_RATE_5_5MBPS = 2,
+    HW_RATE_11MBPS  = 3,
+    HW_RATE_6MBPS   = 4,
+    HW_RATE_9MBPS   = 5,
+    HW_RATE_12MBPS  = 6,
+    HW_RATE_18MBPS  = 7,
+    HW_RATE_24MBPS  = 8,
+    HW_RATE_36MBPS  = 9,
+    HW_RATE_48MBPS  = 10,
+    HW_RATE_54MBPS  = 11,
+    HW_RATE_MAX
+};
+
+
 /* c.f RW-WLAN-nX-MAC-HW-UM */
 union rwnx_rate_ctrl_info {
 	struct {

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/lmac_msg.h

@@ -20,6 +20,8 @@
 // for MAC related elements (mac_addr, mac_ssid...)
 #include "lmac_mac.h"
 
+#define LMAC_MSG_MAX_LEN  1024
+
 /*
  ****************************************************************************************
  */
@@ -394,6 +396,27 @@ enum mm_msg_tag {
     MM_SET_VENDOR_SWCONFIG_REQ,
     MM_SET_VENDOR_SWCONFIG_CFM,
 
+    MM_SET_TXPWR_LVL_ADJ_REQ,
+    MM_SET_TXPWR_LVL_ADJ_CFM,
+
+    MM_RADAR_DETECT_IND,
+
+    MM_SET_APF_PROG_REQ,
+    MM_SET_APF_PROG_CFM,
+
+    MM_GET_APF_PROG_REQ,
+    MM_GET_APF_PROG_CFM,
+
+    MM_SET_TXPWR_PER_STA_REQ,
+    MM_SET_TXPWR_PER_STA_CFM,
+
+    MM_GET_STATISTIC_REQ,
+    MM_GET_STATISTIC_CFM,
+
+    MM_VENDOR_SWCONFIG_IND,
+    MM_FW_PANIC_IND,
+    MM_FW_ASSERT_IND,
+
     /// MAX number of messages
     MM_MAX,
 };
@@ -814,6 +837,7 @@ struct mm_key_add_cfm {
 	u8_l status;
 	/// HW index of the key just added
 	u8_l hw_key_idx;
+	u8_l alligned[2];
 };
 
 /// Structure containing the parameters of the @ref MM_KEY_DEL_REQ message.
@@ -1192,6 +1216,18 @@ struct mm_set_rf_config_req
     u32_l data[64];
 };
 
+typedef struct
+{ 
+	u32_l magic_num; /*“GWCR” or ’SWCR”*/
+	u32_l info_flag; 
+	u32_l calib_flag; 
+	u32_l reserved0; 	
+	u32_l res_data[536/sizeof(u32_l)];
+}wf_rf_calib_res_drv_t;
+
+#define DRIVER_GET_WIFI_CALRES_MAGIC_NUM 0x52435747
+#define DRIVER_SET_WIFI_CALRES_MAGIC_NUM 0x52435753
+
 struct mm_set_rf_calib_req {
 	u32_l cal_cfg_24g;
 	u32_l cal_cfg_5g;
@@ -1202,6 +1238,20 @@ struct mm_set_rf_calib_req {
 	u8_l xtal_cap_fine;
 };
 
+struct mm_set_rf_calib_req_v2
+{
+	u32_l cal_cfg_24g;
+	u32_l cal_cfg_5g;
+	u32_l param_alpha;
+	u32_l bt_calib_en;
+	u32_l bt_calib_param;
+    u8_l xtal_cap;
+	u8_l xtal_cap_fine;
+	u8_l reserved0[2];
+	wf_rf_calib_res_drv_t cal_res;
+
+};
+
 struct mm_set_rf_calib_cfm {
 	u32_l rxgain_24g_addr;
 	u32_l rxgain_5g_addr;
@@ -1209,6 +1259,15 @@ struct mm_set_rf_calib_cfm {
 	u32_l txgain_5g_addr;
 };
 
+struct mm_set_rf_calib_cfm_v2
+{
+	u32_l rxgain_24g_addr;
+	u32_l rxgain_5g_addr;
+	u32_l txgain_24g_addr;
+	u32_l txgain_5g_addr;
+	wf_rf_calib_res_drv_t cal_res;
+};
+
 struct mm_get_mac_addr_req {
 	u32_l get;
 };
@@ -1221,10 +1280,20 @@ struct mm_get_sta_info_req {
 	u8_l sta_idx;
 };
 
+struct mm_get_sta_info_compat_req {
+    u8_l sta_idx;
+    char pattern[3];
+};
 struct mm_get_sta_info_cfm {
 	u32_l rate_info;
 	u32_l txfailed;
 	u8    rssi;
+    u8    reserved[3];
+    u32_l chan_time;
+    u32_l chan_busy_time;
+    u32_l ack_fail_stat;
+    u32_l ack_succ_stat;
+    u32_l chan_tx_busy_time;
 };
 
 typedef struct
@@ -1262,8 +1331,31 @@ typedef struct
 
 typedef struct
 {
-    u8_l loss_enable;
-    u8_l loss_value;
+    u8_l enable;
+    s8_l pwrlvl_11b_11ag_2g4[12];
+    s8_l pwrlvl_11n_11ac_2g4[10];
+    s8_l pwrlvl_11ax_2g4[12];
+    s8_l pwrlvl_11a_5g[8];
+    s8_l pwrlvl_11n_11ac_5g[10];
+    s8_l pwrlvl_11ax_5g[12];
+    s8_l pwrlvl_11a_6g[8];
+    s8_l pwrlvl_11n_11ac_6g[10];
+    s8_l pwrlvl_11ax_6g[12];
+} txpwr_lvl_conf_v4_t;
+
+typedef struct
+{
+    u8_l enable;
+    s8_l pwrlvl_adj_tbl_2g4[3];
+    s8_l pwrlvl_adj_tbl_5g[6];
+} txpwr_lvl_adj_conf_t;
+
+typedef struct
+{
+	u8_l loss_enable_2g4;
+	s8_l loss_value_2g4;
+	u8_l loss_enable_5g;
+	s8_l loss_value_5g;
 } txpwr_loss_conf_t;
 
 struct mm_set_txpwr_lvl_req
@@ -1272,9 +1364,14 @@ struct mm_set_txpwr_lvl_req
     txpwr_lvl_conf_t txpwr_lvl;
     txpwr_lvl_conf_v2_t txpwr_lvl_v2;
     txpwr_lvl_conf_v3_t txpwr_lvl_v3;
+	txpwr_lvl_conf_v4_t txpwr_lvl_v4;
   };
 };
 
+struct mm_set_txpwr_lvl_adj_req
+{
+    txpwr_lvl_adj_conf_t txpwr_lvl_adj;
+};
 
 typedef struct {
 	u8_l enable;
@@ -1334,6 +1431,47 @@ typedef struct
     int8_t pwrofst2x_tbl_5g[3][6];
 } txpwr_ofst2x_conf_t;
 
+/*
+ * pwrofst2x_v2_tbl_2g4_ant0/1[3][3]:
+ * +---------------+----------+---------------+--------------+
+ * | ChGrp\RateTyp |  DSSS    | OFDM_HIGHRATE | OFDM_LOWRATE |
+ * +---------------+----------+---------------+--------------+
+ * | CH_1_4        |  [0][0]  |  [0][1]       |  Reserved    |
+ * +---------------+----------+---------------+--------------+
+ * | CH_5_9        |  [1][0]  |  [1][1]       |  Reserved    |
+ * +---------------+----------+---------------+--------------+
+ * | CH_10_13      |  [2][0]  |  [2][1]       |  Reserved    |
+ * +---------------+----------+---------------+--------------+
+ * pwrofst2x_v2_tbl_5g_ant0/1[6][3]:
+ * +-----------------+---------------+--------------+--------------+
+ * | ChGrp\RateTyp   | OFDM_HIGHRATE | OFDM_LOWRATE | OFDM_MIDRATE |
+ * +-----------------+---------------+--------------+--------------+
+ * | CH_42(36~50)    |  [0][0]       |  Reserved    |  Reserved    |
+ * +-----------------+---------------+--------------+--------------+
+ * | CH_58(51~64)    |  [1][0]       |  Reserved    |  Reserved    |
+ * +-----------------+---------------+--------------+--------------+
+ * | CH_106(98~114)  |  [2][0]       |  Reserved    |  Reserved    |
+ * +-----------------+---------------+--------------+--------------+
+ * | CH_122(115~130) |  [3][0]       |  Reserved    |  Reserved    |
+ * +-----------------+---------------+--------------+--------------+
+ * | CH_138(131~146) |  [4][0]       |  Reserved    |  Reserved    |
+ * +-----------------+---------------+--------------+--------------+
+ * | CH_155(147~166) |  [5][0]       |  Reserved    |  Reserved    |
+ * +-----------------+---------------+--------------+--------------+
+ */
+
+typedef struct
+{
+    u8_l enable;
+    u8_l pwrofst_flags;
+    s8_l pwrofst2x_tbl_2g4_ant0[3][3];
+    s8_l pwrofst2x_tbl_2g4_ant1[3][3];
+    s8_l pwrofst2x_tbl_5g_ant0[6][3];
+    s8_l pwrofst2x_tbl_5g_ant1[6][3];
+    s8_l pwrofst2x_tbl_6g_ant0[15];
+    s8_l pwrofst2x_tbl_6g_ant1[15];
+} txpwr_ofst2x_conf_v2_t;
+
 typedef struct
 {
     u8_l enable;
@@ -1346,6 +1484,7 @@ struct mm_set_txpwr_ofst_req {
 	union {
 	  txpwr_ofst_conf_t txpwr_ofst;
 	  txpwr_ofst2x_conf_t txpwr_ofst2x;
+	  txpwr_ofst2x_conf_v2_t txpwr_ofst2x_v2;
 	};
 };
 
@@ -1803,6 +1942,7 @@ struct me_sta_add_cfm {
 	u8_l status;
 	/// PM state of the station
 	u8_l pm_state;
+	u8_l alligned;
 };
 
 /// Structure containing the parameters of the @ref ME_STA_DEL_REQ message.
@@ -1835,11 +1975,31 @@ struct me_traffic_ind_req {
 
 struct mm_apm_staloss_ind
 {
-        u8_l sta_idx;
-        u8_l vif_idx;
-        u8_l mac_addr[6];
+	u8_l sta_idx;
+	u8_l vif_idx;
+	u8_l mac_addr[6];
 };
 
+struct fw_panic_info_ind
+{
+    uint32_t len;
+    uint8_t info[384];
+};
+
+struct fw_assert_info_ind
+{
+    uint32_t len;
+    uint8_t info[384];
+};
+
+#ifdef CONFIG_SDIO_BT
+struct mm_bt_recv_ind
+{
+	u32_l data_len;
+	u8_l bt_data[1024];
+};
+#endif
+
 enum vendor_hwconfig_tag{
 	ACS_TXOP_REQ = 0,
 	CHANNEL_ACCESS_REQ,
@@ -1847,6 +2007,10 @@ enum vendor_hwconfig_tag{
 	CCA_THRESHOLD_REQ,
 	BWMODE_REQ,
 	CHIP_TEMP_GET_REQ,
+	AP_PS_LEVEL_SET_REQ,
+	CUSTOMIZED_FREQ_REQ,
+	WAKEUP_INFO_REQ,
+	KEEPALIVE_PKT_REQ,
 };
 
 enum {
@@ -1874,7 +2038,8 @@ struct mm_set_channel_access_req
 	u8_l  long_nav_en;
 	u8_l  cfe_en;
 	u8_l  rc_retry_cnt[3];
-	s8_l ccademod_th;
+	s8_l  ccademod_th;
+	u8_l  remove_1m2m;
 };
 
 struct mm_set_mac_timescale_req
@@ -1916,6 +2081,12 @@ struct mm_get_chip_temp_cfm
     s8_l degree;
 };
 
+struct mm_set_ap_ps_level_req
+{
+    u32_l hwconfig_id;
+    u8 ap_ps_level;
+};
+
 struct mm_set_vendor_hwconfig_cfm
 {
     u32_l hwconfig_id;
@@ -1924,6 +2095,31 @@ struct mm_set_vendor_hwconfig_cfm
     };
 };
 
+struct mm_set_customized_freq_req
+{
+	u32_l hwconfig_id;
+	u16_l raw_freq[4];
+	u16_l map_freq[4];
+};
+
+struct mm_set_wakeup_info_req
+{
+	u32_l hwconfig_id;
+	u16_l offset;
+	u8_l  length;
+	u8_l  mask_and_patten[];
+
+};
+
+struct mm_set_keepalive_req
+{
+	u32_l hwconfig_id;
+	u16_l code;
+	u16_l length;
+	u32_l intv;
+	u8_l payload[];
+};
+
 struct mm_set_txop_req
 {
 	u16_l txop_bk;
@@ -1934,6 +2130,22 @@ struct mm_set_txop_req
 	u8_l  cfe_en;
 };
 
+#ifdef CONFIG_APF
+struct mm_set_apf_prog_req {
+	u32_l program_len;
+	u32_l offset;
+	u8_l program[LMAC_MSG_MAX_LEN];
+};
+
+struct mm_get_apf_prog_req {
+	u16_l offset;
+};
+
+struct mm_get_apf_prog_cfm {
+	u8_l program[LMAC_MSG_MAX_LEN];
+};
+#endif
+
 struct mm_get_fw_version_cfm
 {
     u8_l fw_version_len;
@@ -1950,6 +2162,9 @@ enum vendor_swconfig_tag
     BCN_CFG_REQ = 0,
     TEMP_COMP_SET_REQ,
     TEMP_COMP_GET_REQ,
+    EXT_FLAGS_SET_REQ,
+    EXT_FLAGS_GET_REQ,
+    EXT_FLAGS_MASK_SET_REQ,
 };
 
 struct mm_set_bcn_cfg_req
@@ -1986,12 +2201,40 @@ struct mm_get_temp_comp_cfm
     s8_l degree;
 };
 
+struct mm_set_ext_flags_req
+{
+    u32_l user_flags;
+};
+
+struct mm_set_ext_flags_cfm
+{
+    u32_l user_flags;
+};
+
+struct mm_get_ext_flags_cfm
+{
+    u32_l user_flags;
+};
+
+struct mm_mask_set_ext_flags_req
+{
+    u32_l user_flags_mask;
+    u32_l user_flags_val;
+};
+
+struct mm_mask_set_ext_flags_cfm
+{
+    u32_l user_flags;
+};
+
 struct mm_set_vendor_swconfig_req
 {
     u32_l swconfig_id;
     union {
         struct mm_set_bcn_cfg_req bcn_cfg_req;
         struct mm_set_temp_comp_req temp_comp_set_req;
+        struct mm_set_ext_flags_req ext_flags_set_req;
+        struct mm_mask_set_ext_flags_req ext_flags_mask_set_req;
     };
 };
 
@@ -2002,9 +2245,25 @@ struct mm_set_vendor_swconfig_cfm
         struct mm_set_bcn_cfg_cfm bcn_cfg_cfm;
         struct mm_set_temp_comp_cfm temp_comp_set_cfm;
         struct mm_get_temp_comp_cfm temp_comp_get_cfm;
+        struct mm_set_ext_flags_cfm ext_flags_set_cfm;
+        struct mm_get_ext_flags_cfm ext_flags_get_cfm;
+        struct mm_mask_set_ext_flags_cfm ext_flags_mask_set_cfm;
     };
 };
 
+#ifdef CONFIG_SDIO_BT
+struct mm_bt_send_req
+{
+	u32_l data_len;
+	u8_l bt_data[1024];
+};
+
+struct mm_bt_send_cfm
+{
+	u8_l status;
+};
+#endif
+
 /// Structure containing the parameters of the @ref ME_RC_STATS_REQ message.
 struct me_rc_stats_req {
 	/// Index of the station for which the RC statistics are requested
@@ -2104,6 +2363,7 @@ struct me_set_ps_mode_req {
 struct me_set_lp_level_req {
 	/// Low Power level
 	u8_l lp_level;
+	u8_l disable_filter;
 };
 
 
@@ -2348,13 +2608,13 @@ struct apm_stop_req {
 /// Structure containing the parameters of the @ref APM_START_CAC_REQ message.
 struct apm_start_cac_req {
 	/// Control channel on which we have to start the CAC
-	struct mac_chan_def chan;
+	struct mac_chan_op chan;
 	/// Center frequency of the first segment
-	u32_l center_freq1;
+	//u32_l center_freq1;
 	/// Center frequency of the second segment (only in 80+80 configuration)
-	u32_l center_freq2;
+	//u32_l center_freq2;
 	/// Width of channel
-	u8_l ch_width;
+	//u8_l ch_width;
 	/// Index of the VIF for which the CAC is started
 	u8_l vif_idx;
 };
@@ -2698,22 +2958,36 @@ enum dbg_msg_tag {
 	/// Memory mask write confirm
 	DBG_MEM_MASK_WRITE_CFM,
 
-        DBG_RFTEST_CMD_REQ,
-        DBG_RFTEST_CMD_CFM,
-        DBG_BINDING_REQ,
-        DBG_BINDING_CFM,
-        DBG_BINDING_IND,
+	DBG_RFTEST_CMD_REQ,
+	DBG_RFTEST_CMD_CFM,
+	DBG_BINDING_REQ,
+	DBG_BINDING_CFM,
+	DBG_BINDING_IND,
 
-        DBG_CUSTOM_MSG_REQ,
-        DBG_CUSTOM_MSG_CFM,
-        DBG_CUSTOM_MSG_IND,
+	DBG_CUSTOM_MSG_REQ,
+	DBG_CUSTOM_MSG_CFM,
+	DBG_CUSTOM_MSG_IND,
 
-        DBG_GPIO_WRITE_REQ,
-        DBG_GPIO_WRITE_CFM,
-        DBG_GPIO_READ_REQ,
-        DBG_GPIO_READ_CFM,
-        DBG_GPIO_INIT_REQ,
-        DBG_GPIO_INIT_CFM,
+	DBG_GPIO_WRITE_REQ,
+	DBG_GPIO_WRITE_CFM,
+	DBG_GPIO_READ_REQ,
+	DBG_GPIO_READ_CFM,
+	DBG_GPIO_INIT_REQ,
+	DBG_GPIO_INIT_CFM,
+
+	/// EF usrdata read request
+	DBG_EF_USRDATA_READ_REQ,
+	/// EF usrdata read confirm
+	DBG_EF_USRDATA_READ_CFM,
+	/// Memory block read request
+	DBG_MEM_BLOCK_READ_REQ,
+	/// Memory block read confirm
+	DBG_MEM_BLOCK_READ_CFM,
+
+	DBG_PWM_INIT_REQ,
+	DBG_PWM_INIT_CFM,
+	DBG_PWM_DEINIT_REQ,
+	DBG_PWM_DEINIT_CFM,
 
 	/// Max number of Debug messages
 	DBG_MAX,
@@ -2758,11 +3032,11 @@ struct dbg_mem_mask_write_cfm {
 struct dbg_rftest_cmd_req {
 	u32_l cmd;
 	u32_l argc;
-	u8_l argv[10];
+	u8_l argv[30];
 };
 
 struct dbg_rftest_cmd_cfm {
-	u32_l rftest_result[18];
+	u32_l rftest_result[32];
 };
 
 struct dbg_gpio_write_req {
@@ -2841,6 +3115,21 @@ struct dbg_mem_block_write_cfm {
 	u32_l wstatus;
 };
 
+/// Structure containing the parameters of the @ref DBG_MEM_BLOCK_READ_REQ message.
+struct dbg_mem_block_read_req
+{
+    u32_l memaddr;
+    u32_l memsize;
+};
+
+/// Structure containing the parameters of the @ref DBG_MEM_BLOCK_READ_CFM message.
+struct dbg_mem_block_read_cfm
+{
+    u32_l memaddr;
+    u32_l memsize;
+    u32_l memdata[1024 / sizeof(u32_l)];
+};
+
 /// Structure containing the parameters of the @ref DBG_START_APP_REQ message.
 struct dbg_start_app_req {
 	u32_l bootaddr;
@@ -2884,6 +3173,12 @@ enum tdls_msg_tag {
 	TDLS_PEER_TRAFFIC_IND_REQ,
 	/// TDLS peer traffic indication confirmation.
 	TDLS_PEER_TRAFFIC_IND_CFM,
+
+#ifdef CONFIG_SDIO_BT
+	TDLS_SDIO_BT_SEND_REQ =  LMAC_FIRST_MSG(TASK_TDLS)+16,
+	TDLS_SDIO_BT_SEND_CFM,
+	TDLS_SDIO_BT_RECV_IND,
+#endif
 	/// MAX number of messages
 	TDLS_MAX
 };

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/rwnx_cmds.c

@@ -46,8 +46,8 @@ static void cmd_complete(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 	//RWNX_DBG(RWNX_FN_ENTRY_STR);
 	lockdep_assert_held(&cmd_mgr->lock);
 
-	list_del(&cmd->list);
-	cmd_mgr->queue_sz--;
+	//list_del(&cmd->list);
+	//cmd_mgr->queue_sz--;
 
 	cmd->flags |= RWNX_CMD_FLAG_DONE;
 	if (cmd->flags & RWNX_CMD_FLAG_NONBLOCK) {
@@ -109,6 +109,20 @@ int cmd_mgr_queue_force_defer(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd
 	return 0;
 }
 
+#if 1
+static void aic8800_start_system_reset_flow(struct aic_sdio_dev *aic)
+{
+    int ret = 0;
+    char *event_string = "DHDISDOWN=1";
+    char *envp[] = { event_string, NULL };
+    printk(KERN_ERR "wlan error reset flow.\n");
+    printk(KERN_ERR "send event.\n");
+	ret=kobject_uevent_env(&aic->dev->kobj, KOBJ_CHANGE,envp);
+	if(!ret)
+	   printk(KERN_ERR "wlan error event send.\n");
+}
+#endif
+
 static int cmd_mgr_queue(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 {
 #ifdef AICWF_SDIO_SUPPORT
@@ -119,18 +133,41 @@ static int cmd_mgr_queue(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 	struct aic_usb_dev *usbdev = container_of(cmd_mgr, struct aic_usb_dev, cmd_mgr);
 #endif
 	bool defer_push = false;
+	u8_l empty = 0;
 
 	//RWNX_DBG(RWNX_FN_ENTRY_STR);
 #ifdef CREATE_TRACE_POINTS
 	trace_msg_send(cmd->id);
 #endif
-	spin_lock_bh(&cmd_mgr->lock);
-
-	if (cmd_mgr->state == RWNX_CMD_MGR_STATE_CRASHED) {
-		printk(KERN_CRIT"cmd queue crashed\n");
-		cmd->result = -EPIPE;
-		spin_unlock_bh(&cmd_mgr->lock);
-		return -EPIPE;
+	if(cmd->e2a_msg != NULL) {
+		do {
+			spin_lock_bh(&cmd_mgr->lock);
+			if(cmd_mgr->state == RWNX_CMD_MGR_STATE_CRASHED) {
+				AICWFDBG(LOGERROR, "cmd queue crashed\n");
+				cmd->result = -EPIPE;
+				spin_unlock_bh(&cmd_mgr->lock);
+				return -EPIPE;
+			}
+			empty = list_empty(&cmd_mgr->cmds);
+			if(!empty) {
+				spin_unlock_bh(&cmd_mgr->lock);
+				if(in_softirq()) {
+					printk("in_softirq:check cmdqueue empty\n");
+					mdelay(10);
+				} else {
+					printk("check cmdqueue empty\n");
+					msleep(50);
+				}
+			}
+		} while(!empty);//wait for cmd queue empty
+	} else {
+		spin_lock_bh(&cmd_mgr->lock);
+		if (cmd_mgr->state == RWNX_CMD_MGR_STATE_CRASHED) {
+			printk(KERN_CRIT"cmd queue crashed\n");
+			cmd->result = -EPIPE;
+			spin_unlock_bh(&cmd_mgr->lock);
+			return -EPIPE;
+		}
 	}
 
 	#ifndef CONFIG_RWNX_FHOST
@@ -185,8 +222,9 @@ static int cmd_mgr_queue(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 		//printk("defer push: tkn=%d\r\n", cmd->tkn);
 	}
 
-	spin_unlock_bh(&cmd_mgr->lock);
+	//spin_unlock_bh(&cmd_mgr->lock);
 	if (!defer_push) {
+		spin_unlock_bh(&cmd_mgr->lock);
 		//printk("queue:id=%x, param_len=%u\n",cmd->a2e_msg->id, cmd->a2e_msg->param_len);
 		#ifdef AICWF_SDIO_SUPPORT
 		aicwf_set_cmd_tx((void *)(sdiodev), cmd->a2e_msg, sizeof(struct lmac_msg) + cmd->a2e_msg->param_len);
@@ -197,9 +235,12 @@ static int cmd_mgr_queue(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 
 		kfree(cmd->a2e_msg);
 	} else {
-        if(cmd_mgr->queue_sz <= 1){
-		    WAKE_CMD_WORK(cmd_mgr);
-        }
+        if(cmd_mgr->queue_sz <= 1) {
+			spin_unlock_bh(&cmd_mgr->lock);
+			WAKE_CMD_WORK(cmd_mgr);
+		} else {
+			spin_unlock_bh(&cmd_mgr->lock);
+		}
 		return 0;
 	}
 
@@ -223,6 +264,8 @@ static int cmd_mgr_queue(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 			}
 		#endif
 
+			aic8800_start_system_reset_flow(sdiodev);
+
 			cmd_dump(cmd);
 			spin_lock_bh(&cmd_mgr->lock);
 			cmd_mgr->state = RWNX_CMD_MGR_STATE_CRASHED;
@@ -232,6 +275,10 @@ static int cmd_mgr_queue(struct rwnx_cmd_mgr *cmd_mgr, struct rwnx_cmd *cmd)
 			}
 			spin_unlock_bh(&cmd_mgr->lock);
 		} else {
+			spin_lock_bh(&cmd_mgr->lock);
+			list_del(&cmd->list);
+			cmd_mgr->queue_sz--;
+			spin_unlock_bh(&cmd_mgr->lock);
 			rwnx_cmd_free(cmd);//kfree(cmd);
 			if (!list_empty(&cmd_mgr->cmds))
 				WAKE_CMD_WORK(cmd_mgr);
@@ -339,6 +386,8 @@ void cmd_mgr_task_process(struct work_struct *work)
 					sdio_err("reg:%d write failed!\n", sdiodev->sdio_reg.wakeup_reg);
 				}
 #endif
+				aic8800_start_system_reset_flow(sdiodev);
+
 				cmd_dump(next);
 				spin_lock_bh(&cmd_mgr->lock);
 				cmd_mgr->state = RWNX_CMD_MGR_STATE_CRASHED;
@@ -347,8 +396,13 @@ void cmd_mgr_task_process(struct work_struct *work)
 					cmd_complete(cmd_mgr, next);
 				}
 				spin_unlock_bh(&cmd_mgr->lock);
-			} else
+			} else {
+				spin_lock_bh(&cmd_mgr->lock);
+				list_del(&next->list);
+				cmd_mgr->queue_sz--;
+				spin_unlock_bh(&cmd_mgr->lock);
 				rwnx_cmd_free(next);//kfree(next);
+			}
 		}
 	}
 
@@ -517,7 +571,7 @@ void aicwf_set_cmd_tx(void *dev, struct lmac_msg *msg, uint len)
     if (sdiodev->chipid == PRODUCT_ID_AIC8801 || sdiodev->chipid == PRODUCT_ID_AIC8800DC ||
         sdiodev->chipid == PRODUCT_ID_AIC8800DW)
         buffer[3] = 0x0;
-    else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80)
+    else if (sdiodev->chipid == PRODUCT_ID_AIC8800D80 || sdiodev->chipid == PRODUCT_ID_AIC8800D80X2)
 	    buffer[3] = crc8_ponl_107(&buffer[0], 3); // crc8
 	index += 4;
 	//there is a dummy word

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/rwnx_cmds.h

@@ -24,7 +24,7 @@
 #ifdef AICWF_USB_SUPPORT
 #define RWNX_80211_CMD_TIMEOUT_MS    2000//300
 #else
-#define RWNX_80211_CMD_TIMEOUT_MS    3000//500//300
+#define RWNX_80211_CMD_TIMEOUT_MS    6000//500//300
 #endif
 #endif
 

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/rwnx_compat.h

@@ -260,11 +260,13 @@ enum ieee80211_radiotap_he_mu_bits {
 
 #define STA_TDLS_INITIATOR(sta) 0
 
-#define REGULATORY_IGNORE_STALE_KICKOFF 0
 #else
 #define STA_TDLS_INITIATOR(sta) sta->tdls_initiator
 #endif
 
+#ifndef REGULATORY_IGNORE_STALE_KICKOFF
+#define REGULATORY_IGNORE_STALE_KICKOFF 0
+#endif
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
 #define cfg80211_rx_mgmt(wdev, freq, rssi, buf, len, flags)             \

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/rwnx_debugfs.c

@@ -1248,6 +1248,12 @@ static ssize_t rwnx_dbgfs_regdbg_write(struct file *file,
     	if(oper== 0) {
 		ret = rwnx_send_dbg_mem_read_req(priv, addr, &mem_read_cfm);
         	printk("[0x%x] = [0x%x]\n", mem_read_cfm.memaddr, mem_read_cfm.memdata);
+	} else if (oper == 1) {
+		ret = rwnx_send_dbg_mem_read_req(priv, addr, &mem_read_cfm);
+		printk("before write : [0x%x] = [0x%x]\n", mem_read_cfm.memaddr, mem_read_cfm.memdata);
+		ret = rwnx_send_dbg_mem_block_write_req(priv, addr, 4, &val);
+		ret = rwnx_send_dbg_mem_read_req(priv, addr, &mem_read_cfm);
+		printk("after write : [0x%x] = [0x%x]\n", mem_read_cfm.memaddr, mem_read_cfm.memdata);
     	}
 
 	return count;
@@ -1261,7 +1267,7 @@ static ssize_t rwnx_dbgfs_vendor_hwconfig_write(struct file *file,
 {
 	struct rwnx_hw *priv = file->private_data;
 	char buf[64];
-	int32_t addr[13];
+	int32_t addr[14];
     int32_t addr_out[12];
 	u32_l hwconfig_id;
 	size_t len = min_t(size_t,count,sizeof(buf)-1);
@@ -1275,10 +1281,10 @@ static ssize_t rwnx_dbgfs_vendor_hwconfig_write(struct file *file,
 	}
 
 	buf[len] = '\0';
-	ret = sscanf(buf, "%x %x %x %x %x %x %x %x %x %x %x %x %x %x",
-                            &hwconfig_id, &addr[0], &addr[1], &addr[2], &addr[3], &addr[4], &addr[5], &addr[6], &addr[7], &addr[8], &addr[9], &addr[10], &addr[11], &addr[12]);
-	if(ret > 14) {
-		printk("param error > 14\n");
+	ret = sscanf(buf, "%x %x %x %x %x %x %x %x %x %x %x %x %x %x %x",
+                            &hwconfig_id, &addr[0], &addr[1], &addr[2], &addr[3], &addr[4], &addr[5], &addr[6], &addr[7], &addr[8], &addr[9], &addr[10], &addr[11], &addr[12], &addr[13]);
+	if(ret > 15) {
+		printk("param error > 15\n");
 	} else {
 		switch(hwconfig_id)
 		    {
@@ -1290,13 +1296,13 @@ static ssize_t rwnx_dbgfs_vendor_hwconfig_write(struct file *file,
 			printk("ACS_TXOP_REQ bk:0x%x be:0x%x vi:0x%x vo:0x%x\n",addr[0],  addr[1], addr[2], addr[3]);
 			break;
 		    case 1:
-			if(ret != 14) {
-			    printk("param error  != 14\n");
+			if(ret != 15) {
+			    printk("param error  != 15\n");
 			    break;}
 			addr[12] = ~addr[12] + 1;
 			ret = rwnx_send_vendor_hwconfig_req(priv, hwconfig_id, addr, NULL);
-			printk("CHANNEL_ACCESS_REQ edca:%x,%x,%x,%x, vif:%x, retry_cnt:%x, rts:%x, long_nav:%x, cfe:%x, rc_retry_cnt:%x:%x:%x ccademod_th %x\n",
-                                addr[0],  addr[1], addr[2], addr[3], addr[4], addr[5], addr[6], addr[7], addr[8], addr[9], addr[10], addr[11], addr[12]);
+			printk("CHANNEL_ACCESS_REQ edca:%x,%x,%x,%x, vif:%x, retry_cnt:%x, rts:%x, long_nav:%x, cfe:%x, rc_retry_cnt:%x:%x:%x ccademod_th %x, remove_1m2m %x\n",
+                                addr[0],  addr[1], addr[2], addr[3], addr[4], addr[5], addr[6], addr[7], addr[8], addr[9], addr[10], addr[11], addr[12], addr[13]);
 			break;
 		    case 2:
 			if(ret != 7) {
@@ -1334,6 +1340,14 @@ static ssize_t rwnx_dbgfs_vendor_hwconfig_write(struct file *file,
                     printk("CHIP_TEMP_GET_REQ degree=%d\n", addr_out[0]);
                 }
             break;
+			case 6://AP_PS_LEVEL_SET_REQ
+				if (ret != 2) {
+					printk("param error != 2\n");
+				} else {
+					ret = rwnx_send_vendor_hwconfig_req(priv, hwconfig_id, addr, NULL);
+					printk("AP_PS_LEVEL_SET_REQ lvl=%d\n", addr[0]);
+				}
+			break;
             default:
 			printk("param error\n");
 			break;
@@ -1400,6 +1414,35 @@ static ssize_t rwnx_dbgfs_vendor_swconfig_write(struct file *file,
                 }
             break;
 
+            case 3: // EXT_FLAGS_SET_REQ
+                if (ret != 2) {
+                    printk("param error != 2\n");
+                } else {
+                    ret = rwnx_send_vendor_swconfig_req(priv, swconfig_id, addr, addr_out);
+                    printk("EXT_FLAGS_SET_REQ set ext_flags=0x%x, get ext_flags=0x%x\n",
+                        addr[0], addr_out[0]);
+                }
+            break;
+
+            case 4: // EXT_FLAGS_GET_REQ
+                if (ret != 1) {
+                    printk("param error != 1\n");
+                } else {
+                    ret = rwnx_send_vendor_swconfig_req(priv, swconfig_id, addr, addr_out);
+                    printk("EXT_FLAGS_GET_REQ get ext_flags=0x%x\n", addr_out[0]);
+                }
+            break;
+
+            case 5: // EXT_FLAGS_MASK_SET_REQ
+                if (ret != 3) {
+                    printk("param error != 3\n");
+                } else {
+                    ret = rwnx_send_vendor_swconfig_req(priv, swconfig_id, addr, addr_out);
+                    printk("EXT_FLAGS_MASK_SET_REQ set ext_flags mask=0x%x, val=0x%x, get ext_flags=0x%x\n",
+                        addr[0], addr[1], addr_out[0]);
+                }
+            break;
+
             default:
                 printk("param error\n");
                 break;
@@ -1706,7 +1749,7 @@ static void idx_to_rate_cfg1(unsigned int formatmod,
 		case FORMATMOD_NON_HT:
 		{
 			r_cfg->formatModTx = formatmod;
-			r_cfg->giAndPreTypeTx = 1;
+			r_cfg->giAndPreTypeTx = 2;
 			r_cfg->mcsIndexTx = mcs;
             break;
 		}
@@ -2053,7 +2096,7 @@ static ssize_t rwnx_dbgfs_last_rx_read(struct file *file,
 		nss = last_rx->ht.mcs / 8;;
 		gi = last_rx->ht.short_gi;
 	} else {
-		BUG_ON((mcs = legrates_lut[last_rx->leg_rate]) == -1);
+		BUG_ON((mcs = legrates_lut[last_rx->leg_rate].idx) == -1);
 		nss = 0;
 		gi = 0;
 	}

osdrv/extdrv/wireless/aic8800/aic8800_fdrv/rwnx_defs.h

@@ -49,6 +49,10 @@
 #ifdef CONFIG_BR_SUPPORT
 #include "aic_br_ext.h"
 #endif /* CONFIG_BR_SUPPORT */
+#ifdef CONFIG_BAND_STEERING
+#include "aicwf_steering.h"
+#endif
+
 
 #define WPI_HDR_LEN    18
 #define WPI_PN_LEN     16
@@ -164,6 +168,41 @@ enum nl80211_mesh_power_mode {
 };
 #endif
 
+#ifdef CONFIG_BAND_STEERING
+enum band_type {
+	BAND_ON_24G = 0,
+	BAND_ON_5G = 1,
+	BAND_ON_60G = 2,
+	BAND_ON_6G = 3,
+	BAND_MAX,
+};
+
+enum WIFI_FRAME_TYPE {
+	WIFI_MGT_TYPE  = (0),
+};
+
+enum WIFI_FRAME_SUBTYPE {
+	WIFI_ASSOCREQ       = (0 | WIFI_MGT_TYPE),
+	WIFI_PROBEREQ       = (BIT(6) | WIFI_MGT_TYPE),
+	WIFI_AUTH           = (BIT(7) | BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+};
+
+struct tmp_feature_sta {
+	u8_l sta_idx;
+	u8_l supported_band;
+};
+
+#if 0
+#define MAX_PENDING_PROBES 3
+struct ap_probe_rsp {
+	u8_l da[6];
+	struct work_struct rsp_work;
+	bool in_use;
+};
+#endif
+#endif
+
+
 /**
  * struct rwnx_bcn - Information of the beacon in used (AP mode)
  *
@@ -349,6 +388,12 @@ struct rwnx_vif {
 			bool create_path;            /* Indicate if we are waiting for a MESH_CREATE_PATH_CFM
 											message */
 			int generation;              /* Increased each time the list of Mesh Paths is updated */
+#ifdef CONFIG_BAND_STEERING
+			u8_l tmp_sta_idx;
+			enum band_type band;
+			u32_l freq;
+			bool start;
+#endif
 			enum nl80211_mesh_power_mode mesh_pm; /* mesh power save mode currently set in firmware */
 			enum nl80211_mesh_power_mode next_mesh_pm; /* mesh power save mode for next peer */
 		} ap;
@@ -376,6 +421,15 @@ struct rwnx_vif {
 
 	struct br_ext_info		ethBrExtInfo;
     #endif /* CONFIG_BR_SUPPORT */
+#ifdef CONFIG_BAND_STEERING
+	struct timer_list steer_timer;
+	struct work_struct steer_work;
+	struct b_steer_priv bsteerpriv;
+#if 0
+	struct workqueue_struct *rsp_wq;
+	struct ap_probe_rsp pb_pool[MAX_PENDING_PROBES];
+#endif
+#endif
 };
 
 #define RWNX_VIF_TYPE(rwnx_vif) (rwnx_vif->wdev.iftype)
@@ -428,6 +482,14 @@ struct aic_sta {
     u8 sta_idx;             /* Identifier of the station */
 	bool he;               /* Flag indicating if the station supports HE */
 	bool vht;               /* Flag indicating if the station supports VHT */
+
+	struct ieee80211_he_cap_elem he_cap_elem;
+	struct ieee80211_he_mcs_nss_supp he_mcs_nss_supp;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0) || defined(CONFIG_VHT_FOR_OLD_KERNEL)
+	__le32 vht_cap_info;
+	struct ieee80211_vht_mcs_info supp_mcs;
+#endif
 };
 #endif
 
@@ -475,6 +537,12 @@ struct rwnx_sta {
 	struct rwnx_tdls tdls; /* TDLS station information */
 	struct rwnx_sta_stats stats;
 	enum nl80211_mesh_power_mode mesh_pm; /*  link-specific mesh power save mode */
+#ifdef CONFIG_BAND_STEERING
+	u32_l link_time;
+	s8_l rssi;
+	u8_l support_band;
+#endif
+
 };
 
 static inline const u8 *rwnx_sta_addr(struct rwnx_sta *rwnx_sta)
@@ -580,12 +648,22 @@ struct amsdu_subframe_hdr {
 
 
 /* rwnx driver status */
+void rwnx_set_conn_state(atomic_t *drv_conn_state, int state);
 
 enum rwnx_drv_connect_status { 
 	RWNX_DRV_STATUS_DISCONNECTED = 0,
 	RWNX_DRV_STATUS_DISCONNECTING, 
 	RWNX_DRV_STATUS_CONNECTING, 
-	RWNX_DRV_STATUS_CONNECTED, 
+	RWNX_DRV_STATUS_CONNECTED,
+	RWNX_DRV_STATUS_ROAMING,
+};
+
+static const char *const s_conn_state[] = {
+    "RWNX_DRV_STATUS_DISCONNECTED",
+    "RWNX_DRV_STATUS_DISCONNECTING",
+    "RWNX_DRV_STATUS_CONNECTING",
+    "RWNX_DRV_STATUS_CONNECTED",
+    "RWNX_DRV_STATUS_ROAMING",
 };
 
 
@@ -706,7 +784,19 @@ struct rwnx_hw {
 
 #ifdef CONFIG_SCHED_SCAN
     bool is_sched_scan;
-#endif//CONFIG_SCHED_SCAN 
+#endif//CONFIG_SCHED_SCAN
+	s8_l temp;
+#ifdef CONFIG_TEMP_CONTROL
+	unsigned long started_jiffies;
+#endif
+#ifdef CONFIG_BAND_STEERING
+	u8_l iface_idx;
+	struct tmp_feature_sta feature_table[NX_REMOTE_STA_MAX + NX_VIRT_DEV_MAX];
+#endif
+
+	ktime_t last_time;
+	char last_alpha2[3];
+
 };
 
 u8 *rwnx_build_bcn(struct rwnx_bcn *bcn, struct cfg80211_beacon_data *new);